Security audit
Security checks for vulnerabilities and agentic risk
This is a Markdown-only image generation workflow whose tool use is disclosed and proportionate to making stylized 3D images.
Before installing, be aware that the skill may use web search to enrich prompts for public facts about places, brands, and movie scenes, and its broad trigger words may make it activate more often than expected. It does not show evidence of hidden code execution, persistence, credential access, or destructive behavior.
The trigger list includes generic terms such as "portrait," "city," "room," "logo," "brand," "product," "meme," and especially "3D," which commonly appear in ordinary conversation outside this skill's intended scope. Because the description provides only keywords without exclusion conditions or tighter context, the skill could be invoked unintentionally.
The skill manifest and description position this as an image-generation assistant, but the body also instructs use of web_search to fetch external information about cities, brands, and movie scenes. This creates a capability mismatch that can surprise users or policy layers, increasing the risk of unnecessary external data access, prompt-injection exposure from search results, and overbroad permissions relative to the declared purpose.
No suspicious patterns detected.
