Security audit

Baoyu Image Gen

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed image-generation helper, but it uses an unpinned `npx -y bun` runtime fallback and persistent configuration flows that deserve review before installation.

Review this before installing if you do not already trust the publisher or runtime path. Prefer installing and using a trusted local `bun` binary instead of allowing `npx -y bun`, choose project-scoped preferences unless you intentionally want cross-project defaults, and verify which API keys and reference images will be available to the selected provider.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:18
Finding: Unpinned Remote Package Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Model or Provider Selection

High

Category: Excessive Agency
Confidence: 90% confidence
Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
${BUN_X} {baseDir}/scripts/main.ts --prompt "Make blue" --image out.png --ref source.png # With reference images (explicit provider/model) ${BUN_X} {baseDir}/scripts/main.ts --prompt "Make blue" --image out.png --provider google --model gemini-3-pro-image-preview --ref source.png # OpenRouter (recommended default model) ${BUN_X} {baseDir}/scripts/main.ts --prompt "A cat" --image out.png --provider openrouter

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger text says to use the skill whenever the user asks to generate, create, or draw images, which is broad enough to match many ordinary requests and cause automatic invocation in contexts the user may not expect. Because this skill can read config files, consume API credentials, and invoke external providers, overbroad routing increases the chance of unintended external actions and data exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the agent to execute npx -y bun when bun is not installed, which downloads and runs code from the package registry without a pinned version or integrity constraint. In an agent context this creates a supply-chain execution path where a compromised, replaced, or unexpectedly changed package version could lead to arbitrary code execution on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill documents loading API keys and .env files from project and home directories, but it does not include a user-facing warning about accessing sensitive credentials or sending prompts/reference images to third-party services. In an agent setting, silent credential discovery combined with external network calls can violate user expectations and increase the risk of accidental secret handling or disclosure.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The documented flow explicitly creates or updates EXTEND.md and then continues operation, establishing persistent state across requests. Session persistence is risky here because saved defaults can influence future runs in ways the user may not expect, especially when stored in a user-wide location that affects multiple projects.
Content: Scanner excerpt · references/config/first-time-setup.md (reported line 27)May include surrounding context.
md
│ │ ▼ ▼ ┌─────────────────────┐ ┌──────────────────────┐ │ Create EXTEND.md │ │ Update EXTEND.md │ └─────────────────────┘ └──────────────────────┘ │ │ ▼ ▼

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to create or write a project- or user-scoped EXTEND.md configuration file without an explicit warning, preview, or confirmation step before persisting changes. Because one save location is under $HOME, this can create lasting cross-project state and silently alter future behavior, which is risky even though the configuration content is not itself obviously malicious.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The update flow says to read and modify an existing EXTEND.md, or add a default_model section if missing, without requiring safeguards around overwriting existing configuration. This is dangerous because it can silently change established settings and persist altered defaults that affect subsequent image-generation operations beyond the current request.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.