Security audit
Security checks for vulnerabilities and agentic risk
This image tool needs review because it directs agents to send task commands and diagnostics to hosted feedback without first obtaining your permission.
Make hosted feedback opt-in and review and redact its contents before submission. Avoid confidential material unless durable hosted result links are acceptable. Prefer reviewed, pinned package versions and workspace-scoped installation, and set a spending limit. The external CLI and backend were not audited; the Review verdict rests on the artifact's insufficient control over diagnostic disclosure, not evidence of intentional theft.
Although updating the legacy-named skill could support installation or compatibility, that is the entirety of the supplied code. It neither implements the advertised image workflow nor explicitly forwards requests to the canonical Luxin runtime. The observable behavior is therefore materially narrower and maintenance-focused. No unrelated data access or exfiltration is evident.
The first command automatically downloads and executes luxin-cli@latest, allowing the executed code to change without review. Although this is a CLI rather than an MCP server, a compromised package release could execute with the agent's local permissions; the no-spend guide does not prevent that risk.
The main generation command executes the mutable luxin-cli@latest package with automatic confirmation. A compromised release could access local files or credentials, and the image-spend limit does not restrict the package's local code execution.
The installation command invokes an unpinned skills package and installs skill content from a GitHub reference without an immutable revision. Compromise of either mutable source could introduce executable code or malicious agent instructions, with the global installation persisting the latter across tasks.
The alternative installation command also runs an unpinned npm installer and retrieves mutable repository content. Its legitimate purpose does not remove the supply-chain risk: a compromised update could execute locally or persist adversarial instructions in the globally installed skill.
The writable-home fallback repeats the unpinned installer and mutable skill-source risks. Changing HOME and CODEX_HOME changes installation locations but does not sandbox the installer or prevent access to the rest of the agent's environment.
Retrieving guidance runs luxin-cli@latest locally rather than merely reading documentation. This exposes the agent to mutable package code before it obtains the guidance, and compromised output could additionally supply adversarial workflow instructions.
The refresh command invokes an unpinned skills package and permits changes to installed agent instructions. Requiring an explicit refresh reduces silent-update risk, but the exported revision identifier does not pin or authenticate the installer or incoming skill content.
The fallback instructs agents to submit attempted commands and diagnostic details to hosted feedback without requiring redaction or approval. These details can contain private prompts, image URLs, local paths, or credentials from failed commands, creating an unnecessary disclosure channel beyond the image-generation task.
