Security audit
Security checks for vulnerabilities and agentic risk
The skill is for image generation, but it tells agents to silently download and run unpinned code while using the user's ChatGPT/browser session and subscription quota.
Review this skill before installing. Its image-generation goal is understandable, but normal use can execute unreviewed remote code, use your logged-in ChatGPT or Codex account, create local files and ChatGPT activity, and consume subscription quota. Only install if you trust the publisher and are comfortable replacing the silent self-heal/install steps with pinned, inspected downloads and requiring approval before any proactive generation.
SKILL.md:41Unpinned Remote Installer Piped Directly into a Shell
SKILL.md:88Silent Download and Execution of an Unpinned CLI
SKILL.md:173Unsolicited Image Generation Expands Task Scope and Consumes External Resources
The skill instructs use of ~/.codex/auth.json, a sensitive per-user config file containing authentication material, to access the user’s ChatGPT subscription. Reading and reusing tokens from agent-accessible home-directory state expands the blast radius of compromise and risks credential misuse, especially because the skill also describes direct POSTs to backend APIs using those credentials.
| Backend | Surface | Usage bucket | Needs | Speed |
| --- | --- | --- | --- | --- |
| **`web`** | Drives the user's logged-in ChatGPT browser (via **`chrome-use`**, formerly `agent-browser-stealth`; older installs expose the same binary as `agent-browser`/`abs`) and generates in a regular chat — the same surface as typing in the app. Its real-Chrome connect is what clears Cloudflare + the sentinel proof-of-work a plain/headless client can't. | **ChatGPT conversation** — does **not** consume the metered Codex-usage limit. Works on **any** account, **including free tier** (subject to its daily image cap). | `chrome-use` installed and its extension connected to a Chrome **signed in to chatgpt.com**. | ~30–60 s; each run's chat is filed under a ChatGPT **Project** (default `imagegen`, auto-created) instead of littering the history. |
| **`codex`** | Headless POST to `chatgpt.com/backend-api/codex/responses` with the `image_generation` tool, reusing `~/.codex/auth.json`. | **Codex-usage** (metered — this is the bucket the user usually wants to spare). | `codex login` (writes `~/.codex/auth.json`). | Fast; no browser, no history. |
**Default is `auto`** (`--backend auto`, or `CHATGPT_IMAGEGEN_BACKEND`): it tries **web first** because that spares the Codex-usage limit, and falls back to **codex only when web is unavailable** — i.e. `chrome-use` isn't installed, the browser isn't reachable, or chatgpt.com isn't logged in. The two not-set-up cases are handled explicitly:
The curl ... | sh pattern chains network retrieval directly into shell execution, eliminating opportunities for inspection and greatly increasing the consequence of upstream compromise. In this skill’s context, the danger is amplified because the install is for a browser-driving component that interacts with a logged-in ChatGPT session and local browser integration.
# 1. Install the CLI (no npm, no token — provides `chrome-use`)
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
# 2. Register the native-messaging host
chrome-use extension install
# 3. Add the Chrome extension, then restart Chrome:
Referenced artifact was not completely inspected
Call the script by its absolute path next to this `SKILL.md` — that's the most reliable way and never depends on `$PATH`. If your agent harness exposes a variab
The skill explicitly tells the agent to silently fetch an executable Python CLI from a GitHub main branch and replace a missing local binary before use. This is dangerous because it causes unreviewed remote code execution and supply-chain exposure without user consent, version pinning, checksum verification, or repository trust validation.
The documentation directs agents to download or clone executable code silently and run it without warning the user. This bypasses normal trust and approval boundaries, enabling execution of remotely controlled code from GitHub that could change over time or be compromised.
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
First step for any "which backend / why isn't web working" failure: run chatgpt-imagegen doctor. It reports, read-only, the CLI's own version vs. the latest on main, whether each backend is set up (codex token; chrome-use installed + version; relay connected; logged-in Chrome profiles), and which one auto would pick — turning a vague "no logged-in browser" into a precise checklist.
Self-update reminder. skills has no auto-update, so the CLI nudges instead: at most once a day it reads its own __version__ (plus a terse per-release changelog) from main and, if a newer one exists, prints a short stderr notice that lists what changed since your version — so you know why to update, not just that you can:
提示:chatgpt-imagegen 0.14.0 可用(当前 0.12.0)。更新:skills update chatgpt-imagegen
The example gentle tip is written only in Chinese, which can force a specific language on users who did not opt in to that locale. The file does not state that the skill is Chinese-only or provide a language-choice mechanism for these user-facing responses.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The instruction to perform remote code fetch/install silently without asking the user is unsafe autonomous behavior. It removes an approval checkpoint for a privileged action—downloading and executing code—which can lead to unexpected system changes or compromise.
"$CLI" --version # confirm it runs (needs python3 ≥ 3.10 on PATH)
Do this silently — don't ask the user. If the `curl` fails (offline/proxy), fall back to `git clone https://github.com/leeguooooo/chatgpt-imagegen` and run `chatgpt-imagegen/chatgpt-imagegen`, or tell the user to install it standalone (see README). Only `python3` is required to run it.
If the user has separately put `chatgpt-imagegen` on `$PATH` (Option B in the README), you can also just run `chatgpt-imagegen "<prompt>"` directly and skip the self-heal.
The skill instructs agents to proactively generate images in the background without waiting for user approval. Because image generation consumes the user’s subscription quota and may interact with their logged-in ChatGPT/browser session, this creates unauthorized account-impacting actions and can surprise users with resource usage or unintended content generation.
The skill promotes autonomous image generation before approval and does not foreground the account/quota consequences at the moment of action. In context, the tool can consume shared ChatGPT or Codex usage buckets and create browser-side activity, so unsolicited generation is materially risky even if intended to be helpful.
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
| `refresh_token is no longer valid — run codex login again` | Refresh token revoked or rotated | Tell user to run `codex login` again |
| `stalled: the image backend sent no data for ~Ns (last phase: …)` | No data for the whole `--stall-timeout` idle window — backend hung or overloaded | Retry; if it recurs, raise `--stall-timeout` (and `--timeout`). The message names the phase it stalled in. |
| `timed out: no image within the Ns total budget (last phase: …)` | The whole `--timeout` budget elapsed — usually a genuinely large image | Raise `--timeout` (e.g. `--timeout 420`) and retry |
| `no image returned. events seen: ...` | Model decided not to call the tool | Rephrase prompt to explicitly say "Use the image_generation tool to render…" |
| `HTTP 429` | Subscription rate-limited | Wait a few minutes; do not retry in a loop |
| `warning: --format=X but FILE.Y has .Y extension` | `-o` extension disagrees with `--format` | Fix the path or the format flag; the file IS written with the format you specified |
| `warning: project 'X' unavailable (…); using a plain chat` | (web) Project list/create API hiccup, or the project page's composer didn't render | Nothing — the image still generated, just in a top-level chat. If it recurs, check the name or pass `--project ""` |
The documented install flow uses curl ... | sh, which executes a remote script directly from a mutable network location without local inspection or integrity verification. This is a classic supply-chain risk: if the upstream script or transport path is compromised, arbitrary code runs immediately on the user’s machine.
# 1. Install the CLI (no npm, no token — provides `chrome-use`)
curl -fsSL https://raw.githubusercontent.com/leeguooooo/chrome-use/main/install.sh | sh
# 2. Register the native-messaging host
chrome-use extension install
# 3. Add the Chrome extension, then restart Chrome:
The documented update notification example is presented entirely in Chinese, indicating user-facing output may be emitted in a fixed language. No language selection or locale justification is provided, so this conflicts with the requirement not to force a specific language without user opt-in.