Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent SeaGames media-asset CLI skill with disclosed login, upload, download, and project-canvas actions.
Install only if you trust the SeaGames CLI publisher and intend to let this bundled binary use your SeaGames account to upload assets, create or recover tasks, and attach results to selected projects. Keep session files private, confirm costs and project IDs before paid or canvas-changing commands, use --no-attach for local-only work, and back up important assets before commands that can overwrite files.
Referenced artifact was not completely inspected
使用本 Skill 的 `bin/seagames-cli-windows-x64.exe`、`bin/seagames-cli-linux-x64` 或 `bin/seagames-cli-macos-arm64`。API 由随包配置固定；不调用 PATH 或其他 Skill 中的同名版本。使用匹配环境的已保存会话；
Referenced artifact was not completely inspected
使用本 Skill 的 `bin/seagames-cli-windows-x64.exe`、`bin/seagames-cli-linux-x64` 或 `bin/seagames-cli-macos-arm64`。API 由随包配置固定；不调用 PATH 或其他 Skill 中的同名版本。使用匹配环境的已保存会话；
Referenced artifact was not completely inspected
使用本 Skill 的 `bin/seagames-cli-windows-x64.exe`、`bin/seagames-cli-linux-x64` 或 `bin/seagames-cli-macos-arm64`。API 由随包配置固定；不调用 PATH 或其他 Skill 中的同名版本。使用匹配环境的已保存会话；
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ximage_strong_cutoutimage_panoramaimage_relightimage_multi_angle多角度打光720 全景超强AI抠图functionIdfunction_idrequestInputsinputsFUNCTION_UNAVAILABLEFUNCTION_DISABLEDINSUFFICIENT_CREDITSUNAUTHORIZEDFORBIDDENRATE_LIMITEDFUNCTION_REQUEST_FAILEDrequestIdsuccess功能请求失败，请使用请求 ID 联系支持；不要盲目重复提交saleCreditsexpiresAtchargeModeconfigRevisionidtaskIdprojectIdstatusphasecreatedAtupdatedAtcompletedAtwidthsizeBytescdnUrlresourceIdfunctionNameresultResourcesmultiAnglerelightingdescriptionerrorMessage功能执行失败，请使用任务 ID 查询或联系支持/api/v1/generation/quotes/api/v1/image/outpaint/quotes/api/v1/image/repaint/quotes/api/v1/image-prompt-reverse/quotes/api/v1/model-functions/prompt_beautify/quotes/api/v1/image-decompositions//quotes/api/v1/resources/retryabledetailsRESOURCE_DURATION_UNAVAILABLERESOURCE_REFERENCE_NOT_READYRESOURCE_NOT_READYfaileddeletedblockedReference
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ximage_strong_cutoutimage_panoramaimage_relightimage_multi_angle多角度打光720 全景超强AI抠图functionIdfunction_idrequestInputsinputsFUNCTION_UNAVAILABLEFUNCTION_DISABLEDINSUFFICIENT_CREDITSUNAUTHORIZEDFORBIDDENRATE_LIMITEDFUNCTION_REQUEST_FAILEDrequestIdsuccess功能请求失败，请使用请求 ID 联系支持；不要盲目重复提交saleCreditsexpiresAtchargeModeconfigRevisionidtaskIdprojectIdstatusphasecreatedAtupdatedAtcompletedAtwidthsizeBytescdnUrlresourceIdfunctionNameresultResourcesmultiAnglerelightingdescriptionerrorMessage功能执行失败，请使用任务 ID 查询或联系支持/api/v1/generation/quotes/api/v1/image/outpaint/quotes/api/v1/image/repaint/quotes/api/v1/image-prompt-reverse/quotes/api/v1/model-functions/prompt_beautify/quotes/api/v1/image-decompositions//quotes/api/v1/resources/retryabledetailsRESOURCE_DURATION_UNAVAILABLERESOURCE_REFERENCE_NOT_READYRESOURCE_NOT_READYfaileddeletedblockedReference
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
was started��>@SAPI does not support canvas output profile ; no task was created�>@+C�>@/delivery-capabilitiesx�>@API does not support backend canvas delivery; no generation task was createdcanvas delivery capabilitybackendDeliveryrequiresBrowsergenerationOperations delivery; no task was createdx�>@H�>@outputProfilesmediaTaskOperationsmediaJobOperationsmodelFunctionsimageToolsworkflowTasksdecompositionRunslocalFileGroupsresourceTypesAPI has no compatible backend canvas delivery contract; no generation task was created
�>@V��>@�jdelivery-��>@ ��>@� ��>@�%canvasDeliveryaccepted generation has no task ID; recover using the persisted canvas operation IDCanvas in project ; recover with canvas operation get --operation-id A�>@H�>@��J@T�>@3�kK@��>@
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
seagames-cli image relight-config seagames-cli image relight --resource-id IMAGE --description "温暖侧光" --output relit.png seagames-cli image layer-decompose --resource-id IMAGE --output-dir layers --json seagames-cli image reverse-prompt --resource-id IMAGE --output prompt.txt --json
扩图四边为非负像素，默认各256，可提供 `--prompt` 和 low/medium/high 质量；以实时报价验证范围。打光四种模式互斥：`--preset`、`--description`、`--parameters FILE.json`、`--reference-resource`。预设先查询，参数文件字段 azimuth[-180,180]、elevation[-90,90]、intensity[0,32]、color(#RRGGBB)、softness[0,1]、fill[0,32]、rim(bool)。封装功能不能自选底层模型或内部提示词。
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
seagames-cli image relight-config seagames-cli image relight --resource-id IMAGE --description "温暖侧光" --output relit.png seagames-cli image layer-decompose --resource-id IMAGE --output-dir layers --json seagames-cli image reverse-prompt --resource-id IMAGE --output prompt.txt --json
扩图四边为非负像素，默认各256，可提供 `--prompt` 和 low/medium/high 质量；以实时报价验证范围。打光四种模式互斥：`--preset`、`--description`、`--parameters FILE.json`、`--reference-resource`。预设先查询，参数文件字段 azimuth[-180,180]、elevation[-90,90]、intensity[0,32]、color(#RRGGBB)、softness[0,1]、fill[0,32]、rim(bool)。封装功能不能自选底层模型或内部提示词。
The skill instructs the agent to invoke local executables and shell-like commands extensively, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: a host agent may permit broader shell access than intended, increasing the chance of unintended command execution or use outside the packaged binary. In this context, the skill repeatedly emphasizes using bundled binaries and not PATH, which suggests operational care, but the missing scope declaration still leaves enforcement to external policy rather than the skill itself.
The user-facing description and default prompt are entirely in Chinese, which imposes a specific language on users without indicating any language choice or opt-in. The policy explicitly flags language or locale constraints when the skill does not offer the user a choice.
The entire skill file is written in Chinese and provides no indication that users may choose another language or that the workflow is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation.
The workflow explicitly states that, after validation, the command may replace the original PNG in place and upload the final asset, but it does not present a clear operator-facing warning or require an explicit confirmation step at the point of use. In a content pipeline, this can lead to unintended destructive modification of approved assets or unintended remote delivery if a user misunderstands the command behavior or project binding state.
该技能文件从标题到操作说明全部以中文书写，未见提供多语言选项、用户语言偏好机制，或说明该技能仅面向特定中文团队/区域。根据规则，强制特定语言而无用户选择或明确合理依据，属于自然语言政策风险。
该文件全文以中文编写并直接给出操作性指令，没有说明这是面向特定中文团队、地区合规场景，或允许用户选择其他语言。根据规则，强制特定语言且无用户选择/明确正当理由，属于自然语言层面的语言/locale 政策风险。
The file title and all user-facing instructions are written in Chinese, beginning with 'SeaGames CLI 使用说明', with no indication that other languages are available or that Chinese is required for a region-specific purpose. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.