Security audit
Security checks across malware telemetry and agentic risk
The visible collage tool is narrow, but the bundle also includes an undisclosed Cloudflare image-generation script with embedded credentials and unsafe shell execution.
Review before installing. The local collage script appears purpose-aligned, but the bundled Cloudflare helper should be removed or fully disclosed, the embedded token should be rotated, and the curl shell invocation should be replaced with a safer structured API call before trusting the package.
-H "Content-Type: application/json" \
-d '{json.dumps({"prompt": prompt})}' > /tmp/cf_response.json'''
subprocess.run(cmd, shell=True)
with open('/tmp/cf_response.json', 'r') as f:
data = json.load(f)65/65 vendors flagged this skill as clean.
No suspicious patterns detected.