Image Skill

• Outcome: Pass
• Latest audit: Jun 2, 2026, 7:06 PM
• Version:
  1.0.2

Overview

This skill is a disclosed hosted creative-media integration, with clear but important risks around sending prompts/images to a remote service and enabling optional live-money credit purchases.

Install this only if you are comfortable with a hosted service receiving generation prompts and uploaded images, storing generated assets and activity, and optionally creating payment objects for prepaid credits. Use explicit spend limits, keep IMAGE_SKILL_TOKEN out of prompts/logs, do not provide wallet private keys or card details to the CLI, and require human approval or a preconfigured delegated cap before using the x402 live-money purchase path.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/agent-signups creates or rotates a restricted unclaimed agent token. Request JSON prefers agent_contact as the email-shaped durable contact inbox for the restricted agent identity; human_email remains accepted only as a legacy compatibility alias. The contact is not a requirement that an autonomous agent stop until a specific human is present. Response JSON returns data.agent_contact as the redacted contact and returns the token once as data.token. Store it in the agent runtime secret store; never put it in prompts, logs, issue text, or feedback.
- GET https://api.image-skill.com/v1/whoami returns durable hosted identity for Authorization: Bearer TOKEN.
- GET https://api.image-skill.com/v1/quota returns durable hosted quota for Authorization: Bearer TOKEN.
- GET https://api.image-skill.com/v1/payment-methods returns the no-auth action-only payment rail catalog. It tells agents which currently usable rails are available, whether live money can move, buyer modes (agent_only, hybrid, human_only), browser requirements, agent_initiated, agent_settleable, settlement_blocker, limits, endpoint paths, and recovery commands. Planned, watch-only, fake, and private harness rails are intentionally omitted.
- GET https://api.image-skill.com/v1/credit-packs returns the public pack catalog. Recommended live-money packs include starter-500, builder-2000, and studio-5000. Packs are the default top-up UX; exact quotes remain supported for agents that already know the required credit budget.
- POST https://api.image-skill.com/v1/credit-quotes returns a credit quote for Authorization: Bearer TOKEN. Request JSON: either credits or pack_id, optional payment_method, idempotency_key. Use stripe_checkout for the human Checkout path. Use payment_method stripe_x402.exact.usdc only when credits methods returns it available/quoteable/purchasable/requires_browser:false; treat it as autonomous self-settlement only when agent_settleable:true is also returned. R
...[truncated 25 chars]

• Confidence: 84% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- GET https://api.image-skill.com/v1/whoami returns durable hosted identity for Authorization: Bearer TOKEN.
- GET https://api.image-skill.com/v1/quota returns durable hosted quota for Authorization: Bearer TOKEN.
- GET https://api.image-skill.com/v1/payment-methods returns the no-auth action-only payment rail catalog. It tells agents which currently usable rails are available, whether live money can move, buyer modes (agent_only, hybrid, human_only), browser requirements, agent_initiated, agent_settleable, settlement_blocker, limits, endpoint paths, and recovery commands. Planned, watch-only, fake, and private harness rails are intentionally omitted.
- GET https://api.image-skill.com/v1/credit-packs returns the public pack catalog. Recommended live-money packs include starter-500, builder-2000, and studio-5000. Packs are the default top-up UX; exact quotes remain supported for agents that already know the required credit budget.
- POST https://api.image-skill.com/v1/credit-quotes returns a credit quote for Authorization: Bearer TOKEN. Request JSON: either credits or pack_id, optional payment_method, idempotency_key. Use stripe_checkout for the human Checkout path. Use payment_method stripe_x402.exact.usdc only when credits methods returns it available/quoteable/purchasable/requires_browser:false; treat it as autonomous self-settlement only when agent_settleable:true is also returned. Response includes quote_id, credits, price_amount_cents, currency, accepted_payment_method, pack_id, pack, and live_money. One credit equals $0.01, so price_amount_cents equals credits. This does not grant credits.
- POST https://api.image-skill.com/v1/credit-purchases/stripe-x402-deposits creates a browserless action-required USDC deposit attempt for a stripe_x402.exact.usdc quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, accepted_payment_method: stripe_x402.exact.usdc, live_money, amount_cents, stripe_x402 challenge metada
...[truncated 26 chars]

• Confidence: 77% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/credit-quotes returns a credit quote for Authorization: Bearer TOKEN. Request JSON: either credits or pack_id, optional payment_method, idempotency_key. Use stripe_checkout for the human Checkout path. Use payment_method stripe_x402.exact.usdc only when credits methods returns it available/quoteable/purchasable/requires_browser:false; treat it as autonomous self-settlement only when agent_settleable:true is also returned. Response includes quote_id, credits, price_amount_cents, currency, accepted_payment_method, pack_id, pack, and live_money. One credit equals $0.01, so price_amount_cents equals credits. This does not grant credits.
- POST https://api.image-skill.com/v1/credit-purchases/stripe-x402-deposits creates a browserless action-required USDC deposit attempt for a stripe_x402.exact.usdc quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, accepted_payment_method: stripe_x402.exact.usdc, live_money, amount_cents, stripe_x402 challenge metadata, stripe_x402.payable_instructions when Stripe returns a Base deposit address, and next.agent_action: pay_stripe_crypto_deposit. A wallet-equipped agent can pay the exact USDC token_amount_atomic to payable_instructions.deposit_address on Base. This does not grant credits; verified settlement/webhook fulfillment grants paid credits exactly once.
- POST https://api.image-skill.com/v1/credit-purchases/stripe-checkout-sessions creates a Stripe Checkout Session for a stripe_checkout quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, checkout_session_id, checkout_handoff_url, checkout_compact_url, checkout_url, accepted_payment_method: stripe_checkout, and next.human_action: open_checkout_url. Present checkout_handoff_url to humans because it is short and redirects to Stripe; checkout_compact_url is also copy-safe when present. If no handoff URL is available, present the full
...[truncated 26 chars]

• Confidence: 86% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/credit-purchases/stripe-x402-deposits creates a browserless action-required USDC deposit attempt for a stripe_x402.exact.usdc quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, accepted_payment_method: stripe_x402.exact.usdc, live_money, amount_cents, stripe_x402 challenge metadata, stripe_x402.payable_instructions when Stripe returns a Base deposit address, and next.agent_action: pay_stripe_crypto_deposit. A wallet-equipped agent can pay the exact USDC token_amount_atomic to payable_instructions.deposit_address on Base. This does not grant credits; verified settlement/webhook fulfillment grants paid credits exactly once.
- POST https://api.image-skill.com/v1/credit-purchases/stripe-checkout-sessions creates a Stripe Checkout Session for a stripe_checkout quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, checkout_session_id, checkout_handoff_url, checkout_compact_url, checkout_url, accepted_payment_method: stripe_checkout, and next.human_action: open_checkout_url. Present checkout_handoff_url to humans because it is short and redirects to Stripe; checkout_compact_url is also copy-safe when present. If no handoff URL is available, present the full checkout_url in a code block. Do not remove the Stripe # fragment; Checkout needs it in the browser. Stripe-hosted Checkout may accept operator-provided promotion codes; humans enter them on Stripe, not in the Image Skill CLI. This does not grant credits; verified Stripe webhook fulfillment grants paid credits exactly once.
- GET https://api.image-skill.com/v1/credit-purchases/status returns durable payment state for Authorization: Bearer TOKEN. Query with exactly one of quote_id, payment_attempt_id, checkout_session_id, or receipt_id. Response includes state, quote, payment_attempt, receipt, credit_event, provider_event, limits, and next.
- GET https://api.image-skill.
...[truncated 26 chars]

• Confidence: 83% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/credit-purchases/stripe-x402-deposits creates a browserless action-required USDC deposit attempt for a stripe_x402.exact.usdc quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, accepted_payment_method: stripe_x402.exact.usdc, live_money, amount_cents, stripe_x402 challenge metadata, stripe_x402.payable_instructions when Stripe returns a Base deposit address, and next.agent_action: pay_stripe_crypto_deposit. A wallet-equipped agent can pay the exact USDC token_amount_atomic to payable_instructions.deposit_address on Base. This does not grant credits; verified settlement/webhook fulfillment grants paid credits exactly once.
- POST https://api.image-skill.com/v1/credit-purchases/stripe-checkout-sessions creates a Stripe Checkout Session for a stripe_checkout quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, checkout_session_id, checkout_handoff_url, checkout_compact_url, checkout_url, accepted_payment_method: stripe_checkout, and next.human_action: open_checkout_url. Present checkout_handoff_url to humans because it is short and redirects to Stripe; checkout_compact_url is also copy-safe when present. If no handoff URL is available, present the full checkout_url in a code block. Do not remove the Stripe # fragment; Checkout needs it in the browser. Stripe-hosted Checkout may accept operator-provided promotion codes; humans enter them on Stripe, not in the Image Skill CLI. This does not grant credits; verified Stripe webhook fulfillment grants paid credits exactly once.
- GET https://api.image-skill.com/v1/credit-purchases/status returns durable payment state for Authorization: Bearer TOKEN. Query with exactly one of quote_id, payment_attempt_id, checkout_session_id, or receipt_id. Response includes state, quote, payment_attempt, receipt, credit_event, provider_event, limits, and next.
- GET https://api.image-skill.
...[truncated 26 chars]

• Confidence: 83% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/credit-purchases/stripe-checkout-sessions creates a Stripe Checkout Session for a stripe_checkout quote. Request JSON: quote_id, idempotency_key. Response includes state: action_required, payment_attempt_id, checkout_session_id, checkout_handoff_url, checkout_compact_url, checkout_url, accepted_payment_method: stripe_checkout, and next.human_action: open_checkout_url. Present checkout_handoff_url to humans because it is short and redirects to Stripe; checkout_compact_url is also copy-safe when present. If no handoff URL is available, present the full checkout_url in a code block. Do not remove the Stripe # fragment; Checkout needs it in the browser. Stripe-hosted Checkout may accept operator-provided promotion codes; humans enter them on Stripe, not in the Image Skill CLI. This does not grant credits; verified Stripe webhook fulfillment grants paid credits exactly once.
- GET https://api.image-skill.com/v1/credit-purchases/status returns durable payment state for Authorization: Bearer TOKEN. Query with exactly one of quote_id, payment_attempt_id, checkout_session_id, or receipt_id. Response includes state, quote, payment_attempt, receipt, credit_event, provider_event, limits, and next.
- GET https://api.image-skill.com/v1/models returns the public model registry. Query params: available=true returns currently usable executable rows, executable=true returns runtime-wired rows regardless current availability, catalog_only=true returns source-backed catalog-only rows, operation=image.generate|image.edit narrows by operation, and provider=fal|xai|openai narrows by provider. Default list output excludes catalog-only rows so fresh agents see executable candidates first. The response summary includes total, returned, available, executable, cataloged_not_wired, provider split, execution_availability, first_actionable_model_ids, recommended filter commands, and catalog-inclusion flags. For runnable choices require both status: available 
...[truncated 26 chars]

• Confidence: 87% confidence
• Finding: https://api.image-skill.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

- POST https://api.image-skill.com/v1/edit edits an Image Skill-owned input asset when Authorization: Bearer TOKEN has quota and the relevant preview grant. Request JSON: input_asset_id, prompt, optional mask_asset_id for mask-capable models, optional references[] for reference-capable models, optional model, optional intent, optional aspect_ratio, optional output constraints, optional model_parameters, optional max_estimated_usd_per_image, optional max_usd, optional accept_unknown_cost. references[] items use asset_id, role, index, optional reference_index for element_reference, and optional reference_task for reference_image; do not put URLs in references[]. Current public references[] support covers Kling Image O1, Kling Image O3 image-to-image/text-to-image, Kling Image v3 image-to-image/text-to-image, Fal DreamO create, and xAI Grok Imagine image edit/quality edit. Kling references allow max 40 entries, max 10 contiguous element indexes from 0, one frontal per referenced element, and up to 3 reference images per element. DreamO references allow up to two contiguous reference_image indexes from 0, each with optional reference_task ip, id, or style. xAI edit references allow up to two contiguous reference_image indexes from 0 and do not accept reference_task; the primary input asset is the first source image. Reference assets must be owned PNG/JPEG/WebP, 10MB max, minimum 300px width/height, and aspect ratio 0.40-2.50. The public CLI uploads local paths or external URLs first for --input, --mask, --element-frontal, --element-reference, and --reference-image; do not send source bytes, external URLs, image_url, image_urls, mask_url, raw provider elements, frontal_image_url, reference_image_urls, first_image_url, second_image_url, images, or *_reference_task to /v1/edit or /v1/create. For Kling elements, --element-frontal IMAGE[@ELEMENT_INDEX] sends role element_frontal and --element-reference IMAGE[@ELEMENT_INDEX[:REFERENCE_INDEX]] sends role element_reference unde
...[truncated 26 chars]

• Confidence: 80% confidence
• Finding: https://api.image-skill.com/

VirusTotal

58/58 vendors flagged this skill as clean.