Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward external AI image-conversion API wrapper, but users should know their image URL and prompt are sent to ngmob.com for processing.
Install only if you are comfortable sending the provided public image URL and prompt to ngmob.com's API. Do not submit private, sensitive, non-consensual, or access-controlled image URLs unless you understand the provider's privacy and retention practices.
The README describes uploading an image URL and prompt to an AI-driven image-processing workflow but does not clearly warn users that their supplied content will be transmitted to an external processing service. This can mislead users about data handling and privacy exposure, especially if they submit private image URLs or sensitive prompts assuming local-only processing.
The skill asks users to supply a public image URL and names external endpoints for product and API access, but it does not clearly warn that the provided image URL and associated image content will be sent to third-party infrastructure for processing. This creates a privacy and transparency issue because users may unknowingly expose personal or sensitive images, and URL-based ingestion can also reveal metadata or access patterns to external services.
The skill is designed to call an external API endpoint, which means user content and potentially account-linked usage data are transmitted outside the local platform boundary. In an image-generation skill this is contextually expected, but it still creates exposure to third-party data collection, logging, or misuse if not clearly disclosed and governed.
"author": "your-name",
"type": "api",
"category": "image-generation",
"endpoint": "https://api.ngmob.com/api/v1/workflows/ffd6peHk6HRoiCCrpOuQ/run",
"method": "POST",
"headers": {
"Content-Type": "application/json",
The manifest sends user-supplied image URLs and prompts to a third-party API, but the skill description and manifest provide no user-facing disclosure that this content leaves the platform. Images and prompts can contain sensitive personal data, and silent transmission to an external service creates a privacy and data-handling risk even if the API is expected for functionality.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
],
"polling": {
"enabled": true,
"url": "https://api.ngmob.com/api/v1/workflows/executions/{{task_id}}",
"method": "GET",
"headers": {
"Authorization": "Bearer {{API_KEY}}"
No suspicious patterns detected.