Flux Image Generator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward helper for using a Flux-capable image-generation CLI, with ordinary API-key and paid-credit cautions.

Before installing, verify that ai-media-generator and the linked homepage are the package and service you intend to trust. Use a dedicated, revocable API key with limited credit exposure where possible, avoid sharing terminal output from config show if it prints secrets, and confirm the base URL before generating images because requests may spend credits.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill documentation instructs users to set an API key directly via CLI commands but provides no warning about secret handling, shell history exposure, or avoiding hardcoding keys in shared terminals/scripts. In a skill specifically designed to interact with a paid external service, this increases the chance of credential leakage and subsequent unauthorized API usage or billing abuse.

VirusTotal

64/64 vendors flagged this skill as clean.