Security audit

Cn Meme Generator

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says: generate memes, with an AI mode that uses an external image-generation service.

Install only if you are comfortable with AI-mode prompts being sent to Pollinations. Do not put secrets, personal data, unreleased business content, or confidential text into prompts unless the skill adds a clear privacy notice and opt-in flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill explicitly states that AI mode uses the Pollinations free API, which means user-provided prompts are transmitted to a third-party service. However, the documentation does not clearly warn users that their input leaves the local environment, may be logged by the provider, or may be subject to that provider’s retention and privacy practices. In a meme generator this is less dangerous than in a secrets-handling skill, but users may still unknowingly submit sensitive or personal text.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: In AI mode, the script transmits the user-supplied prompt to a third-party service at image.pollinations.ai without any explicit consent, warning, or data-handling notice. If users place sensitive, personal, or proprietary information in prompts, that data may be disclosed to an external provider and logged outside the local environment.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.