Security checks across malware telemetry and agentic risk
This skill mostly matches its image-generation purpose, but unsafe input handling and API-key forwarding create review-worthy risk before installation.
Review before installing. Use a limited KIE API key, avoid passing untrusted text to `models --category`, keep Drive upload disabled unless needed, and delete `images/` plus `.task-state.json` when prompts or outputs are sensitive. A safer release should validate download hosts before sending Authorization headers and replace the inline `python3 -c` category handling with a properly parsed script.
}
req = urllib.request.Request(url, headers=headers)
with urllib.request.urlopen(req, timeout=30) as response:
with open(output_path, 'wb') as f:
f.write(response.read())
return True}
req = urllib.request.Request(url, headers=headers)
with urllib.request.urlopen(req, timeout=30) as response:
with open(output_path, 'wb') as f:
f.write(response.read())
return True64/64 vendors flagged this skill as clean.