Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly does what it advertises, but it needs review because it uses client data, AI providers, web-host credentials, public uploads, insecure FTP, and a default local SSH key path.
Review before installing. Use this only with client data you are allowed to send to the selected AI and image providers. Prefer SSH with an explicitly provided limited-purpose key, avoid FTP, avoid passing secrets directly on the command line, and verify upload destinations because generated images may become public.
print("ERROR: no LLM key. Pass --llm-key (the only env var in this package is HIGHLEVEL_ACCESS_TOKEN).", file=sys.stderr)
sys.exit(2)
model = llm_model or "deepseek-chat"
base = llm_base or "https://api.deepseek.com/chat/completions"
body = json.dumps({
"model": model,
"messages": [{"role": "user", "content": prompt}],import subprocess
conn = ["-i", key, "-o", "ConnectTimeout=15", "-o", "StrictHostKeyChecking=accept-new"]
dest = f"{user}@{host}:{remote_path}"
r = subprocess.run(["scp"] + conn + [local, dest], capture_output=True, text=True)
if r.returncode != 0:
raise RuntimeError(f"scp failed: {r.stderr[-300:]}")user, host = ssh_host.split("@", 1)
else:
user, host = (args.ssh_user or "root"), ssh_host
key = args.ssh_key or os.path.expanduser("~/.ssh/id_rsa")
upload_fn = lambda local, remote: ssh_upload(host, user, key, local, remote)
upload_host = host
print(f" upload via SSH: {user}@{host}:{args.ssh_remote_dir}", file=sys.stderr)No suspicious patterns detected.