Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Gemini image generator/editor that uses a user-provided API key and sends prompts or input images to Google as part of its stated purpose.
Install this only if you are comfortable sending image prompts and any --input image to Google's Gemini API using your GEMINI_API_KEY. Avoid using confidential images or secrets in prompts unless that external processing is acceptable for your use case.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def get_api_key():
"""Get API key from environment."""
key = os.environ.get("GEMINI_API_KEY")
if not key:
print("Error: GEMINI_API_KEY environment variable not set", file=sys.stderr)
The skill uses sensitive capabilities—environment access for GEMINI_API_KEY and outbound network access to Google's API—but does not declare an explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: users and platforms cannot easily reason about or restrict what the skill is allowed to access, increasing the risk of unintended secret exposure or unauthorized external communication.
The skill description and usage guidance do not clearly warn that user prompts and any input images are sent to Google's Gemini API for processing. This is dangerous because users may provide confidential text or sensitive images under the false assumption that processing is local, especially given the emphasis on 'stdlib only' and 'works anywhere' rather than remote data handling.
No suspicious patterns detected.