Security checks across malware telemetry and agentic risk
This skill provides creative delivery tools, but it can publish arbitrary content to public or persistent third-party services without strong consent or visibility controls.
Install only in environments where agents are allowed to send prompts and deliverables to Replicate, Pinata/IPFS, and GitHub. Do not configure the service tokens for workspaces containing secrets, private code, customer data, or unreleased business content unless you also enforce human review before IPFS uploads or public repository creation.
const jwt = process.env.PINATA_JWT;
if (!jwt) return null;
try {
const resp = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwt}` },
body: JSON.stringify({const formData = new FormData();
formData.append('file', new Blob([new Uint8Array(buffer)], { type: mimeType }), filename);
formData.append('pinataMetadata', JSON.stringify({ name: filename }));
const resp = await fetch('https://api.pinata.cloud/pinning/pinFileToIPFS', {
method: 'POST',
headers: { Authorization: `Bearer ${jwt}` },
body: formData,'Content-Type': 'application/json', 'X-GitHub-Api-Version': '2022-11-28',
};
try {
const createResp = await fetch('https://api.github.com/user/repos', {
method: 'POST', headers,
body: JSON.stringify({ name: repoName, description, private: false, auto_init: true }),
});if (!token) return { error: 'REPLICATE_API_TOKEN not set. Add it to .env to enable AI image generation.' };
try {
const createResp = await fetch('https://api.replicate.com/v1/models/google/imagen-3/predictions', {
method: 'POST',
headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', Prefer: 'wait' },
body: JSON.stringify({ input: { prompt, aspect_ratio: aspect_ratio || '1:1', output_format: 'png' } }),const jwt = process.env.PINATA_JWT;
if (!jwt) return null;
try {
const resp = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
method: 'POST',
headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${jwt}` },
body: JSON.stringify({const formData = new FormData();
formData.append('file', new Blob([new Uint8Array(buffer)], { type: mimeType }), filename);
formData.append('pinataMetadata', JSON.stringify({ name: filename }));
const resp = await fetch('https://api.pinata.cloud/pinning/pinFileToIPFS', {
method: 'POST',
headers: { Authorization: `Bearer ${jwt}` },
body: formData,'Content-Type': 'application/json', 'X-GitHub-Api-Version': '2022-11-28',
};
try {
const createResp = await fetch('https://api.github.com/user/repos', {
method: 'POST', headers,
body: JSON.stringify({ name: repoName, description, private: false, auto_init: true }),
});if (!createResp.ok) { console.error('[github] Create repo failed:', await createResp.text()); return null; }
const repo = await createResp.json() as { full_name: string; html_url: string; default_branch: string };
const refResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/ref/heads/${repo.default_branch}`, { headers });
const refData = await refResp.json() as { object: { sha: string } };
const commitResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/commits/${refData.object.sha}`, { headers });
const commitData = await commitResp.json() as { tree: { sha: string } };const refResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/ref/heads/${repo.default_branch}`, { headers });
const refData = await refResp.json() as { object: { sha: string } };
const commitResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/commits/${refData.object.sha}`, { headers });
const commitData = await commitResp.json() as { tree: { sha: string } };
const treeItems: Array<{ path: string; mode: string; type: string; sha: string }> = [];const treeItems: Array<{ path: string; mode: string; type: string; sha: string }> = [];
for (const [filePath, fileContent] of Object.entries(files)) {
const blobResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/blobs`, {
method: 'POST', headers, body: JSON.stringify({ content: fileContent, encoding: 'utf-8' }),
});
const blobData = await blobResp.json() as { sha: string };const blobData = await blobResp.json() as { sha: string };
treeItems.push({ path: filePath, mode: '100644', type: 'blob', sha: blobData.sha });
}
const treeResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/trees`, {
method: 'POST', headers, body: JSON.stringify({ base_tree: commitData.tree.sha, tree: treeItems }),
});
const treeData = await treeResp.json() as { sha: string };});
const treeData = await treeResp.json() as { sha: string };
const newCommitResp = await fetch(`https://api.github.com/repos/${repo.full_name}/git/commits`, {
method: 'POST', headers,
body: JSON.stringify({ message: `Job #${jobId} deliverable`, tree: treeData.sha, parents: [refData.object.sha] }),
});body: JSON.stringify({ message: `Job #${jobId} deliverable`, tree: treeData.sha, parents: [refData.object.sha] }),
});
const newCommitData = await newCommitResp.json() as { sha: string };
await fetch(`https://api.github.com/repos/${repo.full_name}/git/refs/heads/${repo.default_branch}`, {
method: 'PATCH', headers, body: JSON.stringify({ sha: newCommitData.sha }),
});if (!token) return { error: 'REPLICATE_API_TOKEN not set. Add it to .env to enable AI image generation.' };
try {
const createResp = await fetch('https://api.replicate.com/v1/models/google/imagen-3/predictions', {
method: 'POST',
headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', Prefer: 'wait' },
body: JSON.stringify({ input: { prompt, aspect_ratio: aspect_ratio || '1:1', output_format: 'png' } }),const deadline = Date.now() + 60000;
while (result.status !== 'succeeded' && result.status !== 'failed' && Date.now() < deadline) {
await new Promise(r => setTimeout(r, 1000));
const pollResp = await fetch(result.urls?.get || `https://api.replicate.com/v1/predictions/${result.id}`, {
headers: { Authorization: `Bearer ${token}` },
});
result = await pollResp.json();}
const url = model.includes(':')
? 'https://api.replicate.com/v1/predictions'
: `https://api.replicate.com/v1/models/${model}/predictions`;
const body: Record<string, any> = { input };
if (model.includes(':')) body.version = model.split(':')[1];const deadline = Date.now() + 300000;
while (result.status !== 'succeeded' && result.status !== 'failed' && Date.now() < deadline) {
await new Promise(r => setTimeout(r, 3000));
const pollResp = await fetch(result.urls?.get || `https://api.replicate.com/v1/predictions/${result.id}`, {
headers: { Authorization: `Bearer ${token}` },
});
result = await pollResp.json();65/65 vendors flagged this skill as clean.