Best Image

• Outcome: Pass
• Latest audit: May 28, 2026 at 4:46 AM UTC
• Version:
  1.0.0

Overview

This skill does what it advertises: it uses a user-provided EvoLink API key to generate or edit images and save the result locally.

Install only if you are comfortable sending prompts, image URLs, and your EvoLink API key to EvoLink and potentially spending API credits. Prefer the Python script over the curl fallback, keep the key in the EVOLINK_API_KEY environment variable, avoid sensitive prompts or private image URLs, and do not set output paths to important existing files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation tells users to run a script that submits their prompt, API key-authenticated request metadata, and any provided image URLs to a third-party service, but it does not clearly disclose that external transmission occurs. In a skill context, users may paste sensitive prompts or internal URLs assuming the action is local, so the missing notice creates a meaningful privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.