Gemini Image
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's code and dependencies match its image-generation purpose, but the runtime instructions ask the agent to create cron jobs and deliver results to external chat channels (Telegram/Discord/Signal) without declaring how credentials or delivery are provided — that's scope creep and deserves caution.
This skill looks like a legitimate Gemini image client (scripts call google-genai and save generated images), but the SKILL.md asks the agent to create cron jobs and to "deliver" images to external chat channels without declaring the required credentials or describing the delivery mechanism. Before installing: 1) Review the scripts yourself — they only implement submit/status/download/clear and save a local .batch_state.json; they do not create crons or post to chat services. 2) If you need automated delivery, implement a secure, explicit delivery mechanism and store channel tokens separately with least privilege. 3) Do not grant broad system permissions (crontab access) to an untrusted agent; prefer manual scheduling or a controlled CI job. 4) Keep GEMINI_API_KEY scoped and rotate if shared; verify the key source (https://aistudio.google.com/apikey). 5) Install Python deps (google-genai, pillow) in an isolated environment before running. If you want to proceed safely, remove or ignore the cron/channel-delivery guidance, or add explicit, audited delivery code that requires explicit credentials.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings for this skill version.
Risk analysis
No visible risk-analysis findings were reported for this release.