Security audit

panda-imagine

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent image-generation skill, but users should understand that prompts and selected reference images are sent to third-party providers and avoid the optional curl-to-bash installer unless they trust it.

Install this only if you trust the image providers you configure. Set only the API keys you intend to use, choose --provider explicitly for sensitive or paid jobs, and do not pass private reference images unless you are comfortable uploading them to the selected provider. Do not run the Jimeng curl-to-bash installer without independently verifying the source or using a safer vendor installation method.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill clearly uses shell execution, environment variables, and networked third-party providers, but the manifest does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: users or the platform may not realize the skill can access secrets and send data externally, increasing the chance of unsafe execution.

Vague Triggers

Medium

Confidence: 77% confidence
Finding: The trigger phrases include very broad everyday terms like '生成图片', '画图', 'generate image', and 'create image', which can cause the skill to activate unintentionally. Because this skill performs networked actions and may consume paid APIs or upload user content, accidental invocation has real privacy and cost implications.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation describes multiple external image providers and reference-image support, but does not prominently warn that prompts, prompt files, and reference images will be transmitted to third-party services. In this context, users may unknowingly upload sensitive text or images to external vendors, creating privacy, confidentiality, and compliance risks.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The code reads arbitrary local reference image paths and sends their contents to Google's API as inline base64 data. In an agent skill context, this creates a real data exfiltration risk because users may not realize that local files supplied as references are uploaded to a third-party provider, especially when the feature accepts filesystem paths directly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The code reads arbitrary local image paths from `args.referenceImages`, converts them to data URLs, and sends them to the MiniMax API. In an agent context, this can exfiltrate local files containing sensitive visual data without any explicit confirmation, warning, or path restriction, making unintended data disclosure plausible.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code reads arbitrary local files from paths in args.referenceImages, converts them to data URLs, and sends them to the OpenRouter API as part of the request. In this image-generation skill context, that means local user images are exfiltrated to a third-party service, and there is no visible consent gate, allowlist, or warning in this provider code to ensure the user understands that local files leave the machine.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The code reads a local reference image and sends its full contents to Replicate as a data URL, which transfers potentially sensitive user data to a third-party provider. In an image-generation skill, this behavior is expected for the feature to work, but it is still a real privacy/security issue if users are not clearly informed that their local images leave the local environment and are processed by an external service.

External Script Fetching

High

Category: Supply Chain
Content: 安装 dreamina CLI: ```bash curl -fsSL https://jimeng.jianying.com/cli | bash dreamina login ```
Confidence: 98% confidence
Finding: The skill instructs users to install software via 'curl ... | bash', which executes remote code immediately without verification. If the remote endpoint, transport, DNS, or distribution pipeline is compromised, this becomes an easy path to arbitrary code execution on the user's machine.

Chaining Abuse

High

Category: Tool Misuse
Content: 安装 dreamina CLI: ```bash curl -fsSL https://jimeng.jianying.com/cli | bash dreamina login ```
Confidence: 97% confidence
Finding: The explicit command chaining into 'bash' removes any review step between fetching remote content and executing it. In a skill that already relies on external tools and credentials, this materially increases the blast radius because a compromised installer could steal API keys, modify shell configs, or establish persistence.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/providers/jimeng.ts:51

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/azure.ts:31

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/dashscope.ts:78

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/google.ts:22

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/jimeng.ts:33

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/minimax.ts:9

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/openai.ts:30

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/openrouter.ts:13

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/replicate.ts:10

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/providers/seedream.ts:36