Security audit
Security checks for vulnerabilities and agentic risk
This skill is an image-generation workflow helper, but it asks for broad command/file authority and includes external sending and browser-session automation with loose scoping.
Review this skill before installing if you do not want broad local command/file access, browser automation against a logged-in Grok account, or generated images sent to Feishu or callbacks. Use it only with explicit output directories and confirmed messaging destinations, and avoid giving it unrelated automation tasks.
The skill advertises generic command execution and information-retrieval capabilities that are much broader than its stated purpose of image generation and workflow automation. In an agent context, unnecessary broad capabilities increase the chance of misuse, prompt-triggered overreach, or execution of unrelated local/system actions beyond user expectations.
The activation guidance is framed around broad productivity and automation use cases instead of narrowly scoped image-generation tasks. Overbroad invocation language can cause an agent to select this skill in unrelated contexts, exposing file write, exec, and external messaging behaviors when the user did not intend them.
The coverage keywords massively expand the skill's apparent applicability, including vague terms like efficiency, automation, and workflow optimization. In an auto-routing environment this can trigger the skill far outside its intended domain, increasing the likelihood of unnecessary command execution, file operations, and third-party data transmission.
The skill promotes sending generated images to external messaging platforms but does not clearly warn about privacy and data-sharing implications. Users may unknowingly transmit sensitive prompts or generated content to third-party services, especially in automated batch workflows.
The skill promotes sending generated images to external messaging platforms but does not clearly warn about privacy and data-sharing implications. Users may unknowingly transmit sensitive prompts or generated content to third-party services, especially in automated batch workflows.
No suspicious patterns detected.
