Security audit
Security checks for vulnerabilities and agentic risk
The skill’s image searches, optional paid downloads, and consent-based catalog suggestions are disclosed and appropriately controlled.
Search terms are sent to Imagen. Free watermarked searches need no account; paid originals use a locally saved Imagen key and should have an explicit total credit budget. Temporary original links grant access to anyone holding them. Optional catalog suggestions send your approved email and request to Imagen. Some interface text is Chinese. Removing the local key does not revoke it remotely.
The supplied command exposes a confirmed request-submission operation that is not included in the declared search-and-download purpose. The underlying script implementation is not supplied, so the command alone does not establish image generation, catalog publishing, or the precise effects of submission.
Without declared permissions the skill's intent is opaque and cannot be validated.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
node /scripts/imagen.mjs download --id --original --max-credits 1 --operation-id --out /original.png
Use the user's **Imagen creator API key**, never a model-provider key, publisher token or browser cookie. The optional local page guides users to `https://imagen.chat/creator`: sign in, create a named key, allow unlocking if desired, and paste the secret locally. Never request keys in chat, expose them in output, or pass them in command arguments or image URLs. Keys are saved owner-readable only in `~/.config/imagen-chat/creator.json`; never read this credential file into model context or distribute it. Local removal does not revoke the remote key. Server keys expire after 90 days and can be revoked on Imagen. Configuration and validation do not spend credits.
Both original operations require an authenticated account and reuse the same entitlement flow:
The manifest describes searching, using and downloading images, plus local selection and account setup. This section additionally directs the agent to collect a contact email and execute demand-submit to send a catalog request to Imagen, a separate remote submission capability not disclosed in that description. Explicit consent and payload minimization mitigate the privacy risk but do not resolve the description-behavior mismatch.
At L18, submitDemand sends a POST to /gallery/demand-requests containing the supplied contact email, image request, and locale. Submitting catalog suggestions is distinct from searching images, retrieving or downloading images, and account setup; the preview and confirmation checks do not make this additional capability part of the manifest's declared purpose.
The test exercises submitDemand and verifies a POST contract to /gallery/demand-requests containing an email address and an image-content request. Creating demand requests is distinct from searching, selecting, or downloading existing images and is not covered by the manifest's optional account setup; the client here is mocked, so this file demonstrates the submission contract rather than an actual network transmission.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
The instruction to keep visible “图 1 / 图 2” labels requires Chinese text in user-facing output regardless of the user's language. Unlike the watermarked-image notice, which explicitly follows the user's language, these labels have no localization option or documented locale-specific justification.
The generated preview hardcodes its heading, guidance, and suggested follow-up in Chinese, regardless of the user's language. No language selection or justification for this locale constraint is provided.
Detected: suspicious.dangerous_exec