Security audit
Security checks across malware telemetry and agentic risk
The skill is mostly a disclosed TikTok slideshow automation tool, but it includes account warm-up and US-audience targeting guidance that may encourage platform manipulation before automated posting.
Review the account warm-up and geo-targeting advice carefully before installing. Use this only for accounts and content workflows that comply with platform rules, keep sensitive prompts/reference images out of remote providers, avoid storing long-lived API keys in shared config files, and keep the default private-draft posting flow unless you intentionally want OpenQuok to create scheduled posts.
const blob = new Blob([buf], { type: 'image/png' });
form.append('image[]', blob, path.basename(ref));
}
const res = await fetch('https://api.openai.com/v1/images/edits', {
method: 'POST',
headers: { Authorization: `Bearer ${apiKey}` },
body: form,return;
}
const res = await fetch('https://api.openai.com/v1/images/generations', {
method: 'POST',
headers: {
Authorization: `Bearer ${apiKey}`,async function generateReplicate(prompt, outPath) {
const replicateModel = model || 'black-forest-labs/flux-1.1-pro';
const createRes = await fetch('https://api.replicate.com/v1/predictions', {
method: 'POST',
headers: {
Authorization: `Token ${apiKey}`,const blob = new Blob([buf], { type: 'image/png' });
form.append('image[]', blob, path.basename(ref));
}
const res = await fetch('https://api.openai.com/v1/images/edits', {
method: 'POST',
headers: { Authorization: `Bearer ${apiKey}` },
body: form,return;
}
const res = await fetch('https://api.openai.com/v1/images/generations', {
method: 'POST',
headers: {
Authorization: `Bearer ${apiKey}`,// ─── Provider: Stability AI ─────────────────────────────────────────
async function generateStability(prompt, outPath) {
const engineId = model || 'stable-diffusion-xl-1024-v1-0';
const res = await fetch(`https://api.stability.ai/v1/generation/${engineId}/text-to-image`, {
method: 'POST',
headers: {
Authorization: `Bearer ${apiKey}`,async function generateReplicate(prompt, outPath) {
const replicateModel = model || 'black-forest-labs/flux-1.1-pro';
const createRes = await fetch('https://api.replicate.com/v1/predictions', {
method: 'POST',
headers: {
Authorization: `Token ${apiKey}`,VirusTotal findings are pending for this skill version.
Detected: suspicious.dangerous_exec