Security audit
Security checks for vulnerabilities and agentic risk
This image-generation skill needs review because it requires uploading diagnostic details that may contain private prompts without asking you first.
Make feedback optional and review its contents before submission, removing confidential prompts, private URLs, credentials, and other tools' results. Review and pin CLI and skill versions, approve global installation deliberately, and retain spending limits. The static scan reported no findings; the review concern comes from the artifact's required diagnostic sharing. External runtime behavior remains unverified.
The supplied chunk's sole operational action is updating the skill itself. Although an update could support a larger workflow, no image-generation workflow is present here, and modification of installed skill content is not disclosed in the description. Any behavior of the fetched CLI or updated skill cannot be established from this snippet.
The supplied command performs a global agent-skill installation rather than the described image-generation workflow. Although installation could support that workflow, this snippet's entire behavior is installing externally supplied skill content, a capability not disclosed in the description. The installed skill's contents are not supplied, so its image-generation behavior and advertised safeguards cannot be verified.
Although this is a CLI rather than an MCP server, npx -y luxin-cli@latest downloads and executes a mutable package release without installation confirmation. A compromised publisher or malicious release could execute code with the agent's filesystem and credential access; the guide's no-spend designation does not constrain local code execution.
The main image-generation command executes luxin-cli@latest, so its executable content can change independently of this reviewed skill. The image-price limit constrains intended service spending, not a compromised CLI's ability to read local data or execute arbitrary operations.
The installation command invokes the unversioned skills package and installs agent instructions from a repository without an immutable revision. A compromised package or repository could execute local code or introduce persistent malicious instructions into the global agent skill directory.
The alternative canonical-skill installation also uses an unversioned executable and mutable repository content. Because it targets global Codex skills, compromised upstream content could influence subsequent agent sessions beyond the current image-generation task.
Redirecting HOME and CODEX_HOME makes the installation destination writable but does not make the unversioned skills executable or repository content trustworthy. These environment changes are not a sandbox, so a compromised installer still runs with the process's existing privileges.
Loading guidance runs luxin-cli@latest as local code, even though the operation appears to be documentation retrieval. This mandatory refresh path exposes the agent to a changed or compromised package before it performs the requested image-generation work.
The update command runs an unversioned skills package and refreshes installed agent instructions from upstream. LUXIN_SKILL_REVISION is described as a mismatch indicator, not an integrity check or immutable update target, so it does not prevent supply-chain replacement.
The fallback instruction requires hosted feedback containing the attempted command, expected behavior, and actual behavior without requiring sanitization or permission. Image-generation commands can contain confidential prompts, and diagnostic output can contain private URLs, identifiers, or credentials, creating an unnecessary disclosure path beyond the generation request.
