Security audit
Security checks for vulnerabilities and agentic risk
This thumbnail skill is not clearly malicious, but it asks the agent to run shell-profile configuration, install a global CLI, and update blog metadata files without a clear consent boundary.
Review before installing. This skill is suitable only if you are comfortable with an agent sourcing your ~/.zshrc, using your configured pixr provider/API key, possibly installing pixr-cli globally with npm, saving images under ~/blog-images, and editing matching ~/blog-meta JSON records automatically. Prefer adding an explicit confirmation step before shell-profile sourcing, package installation, and metadata writes.
Sourcing ~/.zshrc grants the skill access to arbitrary shell startup logic and environment data unrelated to thumbnail generation. Because shell profiles can contain commands, secrets, and side effects, this broadens execution and data exposure beyond the least-privilege needs of the task.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- `hasApiKey` must be `true`. pixr reads `PIXR_API_KEY` (the older `NANO_IMAGE_API_KEY` also works), or the variable named by `apiKeyEnv` in the user's pixr config. These are defined in `~/.zshrc`.
- `model` must not be `null`. pixr has no default model.
CRITICAL NON-NEGOTIABLE: never ask the user to add or set the API key manually. It is already in `~/.zshrc`. Always source it before concluding the key is missing.
If `hasApiKey` is still `false` after sourcing, report the exact output and stop.
If `model` is `null`, list the models for the user's provider and ask the user which one to use. Do not choose one yourself:
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
~/blog-images/ if it does not exist.~/.zshrc in the same shell first):The skill advertises simple thumbnail generation but also instructs the agent to modify JSON metadata files under ~/blog-meta. This expands behavior from content generation into persistent file mutation without clear user consent, creating a scope mismatch that can surprise users and alter existing project state.
The skill directs the agent to overwrite existing blog-meta JSON files by setting thumbnail_path, but does not warn the user that existing data will be modified. Silent persistence changes can corrupt workflows, update the wrong blog record if matching is imprecise, and violate user expectations for a generation-only tool.
The canonical prompt instructs the image generator to 'resarch on web,' which expands the skill beyond simple local thumbnail generation into external-information gathering. That creates unnecessary data-flow and capability scope, and could cause the agent or backing tool to access external resources or behave unpredictably relative to the stated purpose.
The failure-handling steps instruct sourcing ~/.zshrc and inspecting pixr configuration to determine API-key presence, which goes beyond the core task and touches local environment and credential-related state. Even if only checking for 'hasApiKey,' reading shell startup files and config increases exposure to sensitive data and broadens the agent's access unnecessarily.
The skill directs the agent to access API-key-related configuration and shell state without any warning or explicit user consent. This is dangerous because it normalizes credential-adjacent inspection during routine execution and may expose secrets, environment variables, or private local configuration unrelated to generating an image.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
source ~/.zshrc && pixr config --json
hasApiKey must be true; it reads PIXR_API_KEY (or the older NANO_IMAGE_API_KEY). Never ask the user to set it; it lives in ~/.zshrc.
2. If model is null, list the models and ask the user to pick one (never pick for them):
pixr models --no-interactive
No suspicious patterns detected.