Security audit
Security checks for vulnerabilities and agentic risk
The skill is a disclosed Agnes image-generation wrapper, but its local file path handling can upload arbitrary readable files and overwrite arbitrary writable files if misused.
Review before installing. Use it only with trusted prompts and explicit image/output paths, avoid passing sensitive local paths, and prefer a hardened version that restricts inputs and outputs to approved directories and confirms uploads to the Agnes API.
generate.mjs:96Unrestricted Local File Disclosure Through Image Input
generate.mjs:223Arbitrary File Overwrite Through Unvalidated Output Path
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
.env
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cd C:/Users/hevin/.workbuddy/skills/agnes-image-skill
# 复制模板
cp .env.example .env
# 编辑 .env，把你的 key 填进去
# AGNES_API_KEY=sk-...
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cd C:/Users/hevin/.workbuddy/skills/agnes-image-skill
# 复制模板
cp .env.example .env
# 编辑 .env，把你的 key 填进去
# AGNES_API_KEY=sk-...
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function loadEnv() {
const __dirname = dirname(fileURLToPath(import.meta.url));
const envPaths = [
join(__dirname, '.env'),
join(process.cwd(), '.env'),
];
for (const path of envPaths) {
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
function loadEnv() {
const __dirname = dirname(fileURLToPath(import.meta.url));
const envPaths = [
join(__dirname, '.env'),
join(process.cwd(), '.env'),
];
for (const path of envPaths) {
The skill invokes a local Node.js runtime, reads API credentials from .env, and calls an external network endpoint, but the manifest declares no explicit tool scope or permissions. This creates a least-privilege gap: the agent may execute with broader capabilities than users or reviewers expect, increasing the risk of unintended network access or secret exposure through future modifications.
The trigger phrases are broad natural-language expressions like '帮我生成一张图', which can appear in ordinary conversation and may activate the skill unexpectedly. Misfires can cause unplanned script execution, outbound API calls, and consumption of the configured API key or service quota without clear user intent.
The trigger phrase "生成一张图" is very generic and overlaps with common user intents for image generation, making this skill likely to activate when users did not specifically request Agnes Image. In an agent ecosystem with multiple image skills, this can cause unintended routing, surprising external API use, and accidental disclosure of prompts or images to a third-party service.
“当用户出现以下任意意图时触发”配合简短关键词列表，说明了可触发示例，但没有定义触发范围、优先级或不触发场景。尤其“图生图”“把这张图改成 XX 风格”在多技能环境中可能与其他图像编辑能力重叠。
The file's natural-language interface is entirely in Chinese, including the header comments, help text examples, and later CLI error/output strings. This imposes a specific language on users without opt-in or any documented justification that the skill is region-specific, which matches the locale-policy concern for natural-language content.
Detected: suspicious.env_credential_access