Image To Image

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:28 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward AI image-editing CLI guide, with a credential-handling caution around showing configuration after setting an API key.

Before installing, confirm whether `ai-media config show` masks API keys. Avoid sharing terminal output, screenshots, logs, or chat transcripts that may include `AI_MEDIA_API_KEY`, and prefer environment variables or a secret manager when possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly tells users to run both `ai-media config set-key <KEY>` and `ai-media config show`, which can encourage exposing a live API credential in terminal output, logs, screenshots, or shared session transcripts. In a CLI skill whose core purpose is onboarding to a third-party service, this context makes the issue more dangerous because users are likely to follow the steps verbatim while handling real production secrets.

VirusTotal

66/66 vendors flagged this skill as clean.