Agent Selfie

• Risk level: Low
• Analyzed: Apr 30, 2026, 9:01 AM
• Findings: 0
• Version: 1.0.0

Overview

The skill's code, declared requirements, and runtime instructions are coherent with an image-generation wrapper for the SkillBoss API and do not request unrelated credentials or high privileges.

This skill appears to be what it says: a Python wrapper that sends text prompts to api.heybossai.com and saves returned images. Before installing, confirm you trust the SkillBoss API provider and the SKILLBOSS_API_KEY you will supply. Avoid embedding the API key directly into system crontabs or world-readable files (the SKILL.md shows an inline cron example which can expose the key to other users/process listings); instead use protected environment files or a secrets store. Note the script will create output directories and write PNG files (default under ~/Projects/tmp). If you plan to auto-post images to social platforms, understand that this package does not include OAuth/token handling for those services—you would need separate secure integration. Finally, review any personality JSON you pass to ensure it doesn't reference local files you don't intend the tool to read.