Security audit
Security checks for vulnerabilities and agentic risk
The skill is presented as an image-generation guide, but it requests command and file authority while providing no actual implementation, overly broad activation rules, and unsupported safety claims.
Review this skill carefully before installing. It may be useful as image-generation documentation, but do not assume it provides working scripts, enforced command safeguards, JSON validation, or automatic error recovery. Only run commands you can inspect, keep API keys in environment or secret storage, and direct generated images to a dedicated output folder with clear limits.
The skill advertises a structured JSON success output even though the artifact is only Markdown and contains no executable implementation that guarantees this behavior. This can mislead an agent or user into trusting nonexistent validation and downstream parsing guarantees, causing unsafe automation decisions or silent workflow failures.
The document claims command whitelisting, HTTPS verification, and sensitive-output protection, but no code in this artifact enforces those controls. In a skill with exec/write capabilities, false assurances about security controls are dangerous because operators may permit command execution or secret handling under the assumption that safeguards already exist.
The skill claims built-in error handling and recovery despite containing no executable logic that performs such recovery. This creates a false sense of reliability that can cause automated agents to proceed with file writes, API calls, or batch jobs without independent failure checks, increasing the chance of unsafe or inconsistent outcomes.
The trigger condition is extremely broad, effectively suggesting use whenever AI model invocation, agent orchestration, or LLM applications are involved. In an agent ecosystem this can cause the skill to activate outside its intended image-generation scope, increasing the chance of inappropriate exec/write actions, accidental file changes, or misuse of external APIs in unrelated tasks.
The skill describes save, export, modify, and import operations without prominently warning that these actions may alter local files. In a skill that declares write and exec tools, vague operational language can lead agents or users to approve actions that overwrite data, create files in unintended locations, or import unsafe content without informed consent.
The batch-generation examples encourage writing many files and automatic archiving to directories without warning about bulk file creation or storage impact. This can cause disk consumption, clutter, overwrites, or unintended persistence when an agent executes the examples at scale, especially in automated environments.
No suspicious patterns detected.
