Openai Image Gen Hardened

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.0.0

Overview

This skill does what it says: it uses an OpenAI API key to generate images and save a local gallery.

Before installing, understand that this will use your OpenAI API key and may incur image-generation costs. Keep the key in the environment, choose an output directory you trust, and avoid opening generated galleries from untrusted prompt text.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill declares no explicit permissions, yet its documented behavior clearly requires network access, environment-variable access to `OPENAI_API_KEY`, and file writes for generated images, JSON, and HTML output. This mismatch is dangerous because users and policy engines may grant or review the skill under false assumptions, reducing transparency around API-key use, outbound requests, and local artifact creation.

VirusTotal

65/65 vendors flagged this skill as clean.