Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says: it uses a logged-in Doubao browser session to generate and return images, with no hidden code or persistence found.
Install only if you are comfortable sending image prompts and generated content to Doubao through a logged-in account. Avoid sensitive prompts, and periodically clean temporary generated image files from the workspace if privacy matters.
The trigger text is broad enough to route essentially any image-generation request to a skill that automates a logged-in third-party website. That can cause user prompts to be sent off-platform without clear consent and may invoke account-scoped browser actions in situations where a narrower, safer tool would be more appropriate.
The skill instructs the agent to use a logged-in browser session against doubao.com but does not warn that prompts and related content will be transmitted to a third party under the user's account context. In this context, omission of that disclosure is risky because users may unknowingly expose sensitive text or operate through a personal account session.
The prompt guidance and examples push Chinese-language optimization terms without offering locale or language choice. While not a classic security flaw, it can misrepresent user intent and cause unintended transmission or transformation of prompts to a different language, which is more problematic in a third-party browser-automation skill handling user content.
The requirements mention a workspace directory for temporary file storage, and later steps download generated images locally, but the skill does not warn that files will be written to disk. This creates a modest confidentiality and hygiene risk because generated images may persist in temporary storage longer than the user expects.
No suspicious patterns detected.
