Security audit
Security checks for vulnerabilities and agentic risk
This skill is for generating Grok images, but it gives broad automation permissions and can save and send images without clear user-controlled scope.
Review this skill before installing if you do not want agents using Grok in a browser, controlling the desktop to save files, or sending generated images through Feishu. Use it only for explicit Grok image-generation requests, and confirm the save path and recipient before allowing any message send.
The documented input/output contract claims a generic text-processing interface, but the actual workflow performs browser automation, image generation, local file writes, shell commands, and message sending. This mismatch can mislead agents and users about side effects, causing the skill to be invoked under assumptions that no filesystem or outbound data actions will occur.
The skill includes very broad 'use when' guidance around efficiency, automation, batch processing, and workflow optimization, which is far wider than its actual purpose of Grok image generation and sending outputs. Overbroad routing criteria increase the chance an agent will select this skill in unrelated contexts, potentially triggering unnecessary browser automation, file creation, or data transmission.
The skill instructs saving generated images to local directories and sending them through Feishu, but does not require a prominent user warning or confirmation for file creation and external transmission. In an agent setting, hidden side effects on the local filesystem and outbound messaging materially increase privacy and data-handling risk, especially if prompts or images contain sensitive content.
No suspicious patterns detected.
