Security audit
Security checks for vulnerabilities and agentic risk
Review is warranted because the refresh guidance can update unrelated skills, and the advertised spending guard can allow additional charges.
Use a Luxin-only refresh after reviewing changes; avoid the unfiltered all-skills updater. Pin the executable version and set an explicit payment budget. Treat the per-image estimate guard as an estimate rather than a guaranteed final ceiling. Uploaded and generated media use public, non-expiring URLs. The scanner's partial references were independently investigated, but the external CLI implementation remains outside this artifact review.
The supplied chunk is an installation and update workflow, not a media-generation workflow. It contains no signup, generation, pricing, job retrieval, or media-hosting operations. Installation could support the advertised service, but it constitutes the entire supplied behavior and modifies agent skill installations, which the declared description does not disclose.
The supplied command initiates a billing workflow rather than generating media or requesting a generation cost quote. Paid credit purchasing is a materially additional capability, particularly given the description's emphasis on free preview credits and no billing account. The command does not itself demonstrate that payment is completed or a charge is made.
The code requests a credit-purchase deposit rather than generating media or retrieving a generation quote or receipt. Although the description acknowledges spending credits, it does not disclose purchasing or funding credits through Stripe/x402. The snippet does not establish that funds are actually transferred, but it does initiate an undeclared financial workflow. The authentication token alone is not the basis for the mismatch.
The command initiates a credit purchase rather than generating media or obtaining a cost quote. Although the description mentions spending credits and receiving receipts, it does not disclose initiating payment-provider purchases and emphasizes operation without a billing account. A paid credit purchase is a distinct financial action, not merely an implementation detail of media generation.
The supplied command accesses payment-method information rather than generating media, retrieving a generation job, or obtaining a cost quote or receipt. Although it uses the declared service's domain, the billing-resource access is not explained as a supporting step for the stated workflow, which expressly says no billing account is needed. The command does not itself add a payment method or initiate a charge.
Referenced artifact was not completely inspected
- `references/cli.md`: the CLI contract, every command with flags, exit codes, and JSON output.
Referenced artifact was not completely inspected
- `references/llms.txt`: the hosted HTTP API contract, for calling https://api.luxin.sh directly.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
--json
The command refuses to overwrite existing files unless `--overwrite` is
explicit. It verifies byte length when the asset server provides a
`content-length` header. For hosted asset-id downloads, `assets get` preserves
`data.next_actions.self_fund` from the asset metadata response after a
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Hosted API: https://api.luxin.sh for generation, editing, jobs, activity, storage, telemetry, identity, quota, and feedback
- Hosted artifacts: prefer Luxin-owned asset URLs such as https://media.image-skill.com/... when returned in assets[].url
Output rule:
JSON is the default public CLI output. --json is accepted for compatibility and explicitness, but it is not required on every command. stdout carries exactly one JSON document per invocation, so parsing captured stdout never needs a streaming or multi-document reader. During a live (non-dry-run) create or edit the CLI also writes a single in_flight recovery JSON line to stderr before the blocking hosted request; keep the two streams separate rather than combining them with 2>&1. That recovery handle also rides the stdout envelope itself: data.idempotency_key on success, error.recovery.idempotency_key and error.recovery.recover_command on failure, so an agent that captured only stdout can still settle a maybe-charged spend.
Acto
The startup command executes luxin-cli@latest through npx with automatic confirmation, allowing a mutable package release to run with the agent's permissions. A compromised publisher or malicious release could access files and credentials; this is a supply-chain risk even though the package is a CLI rather than an MCP server.
Retrieving usage guidance executes luxin-cli@latest rather than merely reading documentation, exposing the environment to a mutable remote package. The claim that this operation does not spend money or call a provider does not constrain what a compromised package could execute.
The command runs an unpinned skills installer and obtains skill content from a mutable HTTPS source. Automatic confirmation and global installation increase the consequences of a compromised installer or source by making the resulting instructions available across agent sessions.
The command executes an unpinned skills installer and references a repository without an immutable commit. A compromised release or repository change could execute malicious installer code or introduce persistent agent instructions through the global skill installation.
The update command executes an unpinned skills package and can replace installed skill content with newer remote instructions. Although updating is explicitly presented as a manual step, neither the updater nor the resulting skill revision is constrained here to reviewed content.
The guidance explicitly relies on npx luxin-cli@latest, allowing executable code to change independently of the reviewed skill. A compromised package release could execute with the agent's filesystem, credential, and network access; this is a CLI supply-chain issue, not an MCP-server issue.
The refresh command runs the skills package without a pinned version and updates every installed skill. This combines mutable executable dependencies with a broad instruction-update scope, so a compromised release or upstream skill could affect unrelated agent workflows.
The recommended first-run command uses npx -y luxin-cli@latest, automatically executing a mutable npm release. A malicious replacement could access agent credentials or workspace files before the advertised no-spend guide behavior provides any protection.
The installation discussion endorses both an unversioned global installation and execution of luxin-cli@latest. These resolve mutable package releases rather than a reviewed artifact, exposing the agent to supply-chain code execution.
The permissions-recovery example again automatically executes luxin-cli@latest. Making npm paths writable solves installation failures but does not constrain which package code executes or protect secrets available to that process.
Although this occurrence is an inline installation reference rather than a complete shell command, it recommends invoking an unversioned skills package. It contributes to the same mutable-package execution risk as the runnable installation example below.
The command executes an unpinned skills CLI and installs agent instructions from a repository without an immutable revision. Compromise of either source could introduce executable code or persistent adversarial instructions into later agent sessions.
The signup command automatically executes luxin-cli@latest during credential creation and configuration. A compromised release would run at the point where it could capture the newly issued token, despite the documented token-redaction behavior.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Hosted API equivalent:
curl -sS https://api.luxin.sh/v1/quota \
-H "authorization: Bearer $IMAGE_SKILL_TOKEN"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Hosted API equivalent:
curl -sS https://api.luxin.sh/v1/quota \
-H "authorization: Bearer $IMAGE_SKILL_TOKEN"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Hosted API equivalent:
curl -sS https://api.luxin.sh/v1/payment-methods
luxin credits packs list