intelligent-extension

• Risk level: Low
• Analyzed: Apr 27, 2026, 3:57 AM
• Findings: 0
• Version: 1.0.2

Overview

The skill's instructions match its stated purpose (calling Flyelep's image-extension HTTP API); no install or unrelated credentials are requested, but it will send user images/URLs to an external service and the SKILL metadata omits declaring the runtime API key (which must be provided by the user).

This skill appears to do what it says: call Flyelep's HTTP API to extend images. Before installing or using it, consider: (1) Privacy — the skill sends image URLs to an external service (https://www.flyelep.cn). Do not submit images containing private or sensitive data unless you trust the service and its policies. (2) API key handling — the SKILL.md requires a 'secretKey' header at runtime but the skill metadata does not declare a stored credential; supply the key dynamically and do not embed it in skill files. (3) Local files — if your images are not already hosted at public URLs, decide how you'll upload them to a reachable URL before invoking the skill (the instructions don’t cover this). (4) Test carefully using non-sensitive images first, and verify Flyelep's terms/privacy policy and that responses are as expected. If you need the agent to operate autonomously, be aware it could call this API without further prompts — consider restricting autonomous invocation or monitoring requests.