Security audit
Security checks across malware telemetry and agentic risk
This image-generation skill is purpose-aligned, but it needs review because it reads broad local credential files and shows unsafe shell-style execution patterns for generated text.
Review before installing. Use only a dedicated GLM_API_KEY or OPENROUTER_API_KEY, avoid storing unrelated secrets in generic api_key, ~/.claude/config.json, or ~/.env where this script can read them, and do not run it on confidential articles unless you accept the selected provider receiving article-derived prompts. Agents should invoke generate.py with safe structured arguments rather than interpolating generated text into shell commands.
filename = f"{timestamp}_{safe_prompt}.png"
filepath = os.path.join(output_dir, filename)
img_response = requests.get(image_url, timeout=60)
img_response.raise_for_status()
with open(filepath, "wb") as f:
f.write(img_response.content)66/66 vendors flagged this skill as clean.