TS Images

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:26 PM UTC
• Version:
  1.0.0

Overview

This skill is a small, disclosed image-generation API wrapper that sends user-provided JSON to configured image service endpoints using a configured token.

Install only if you trust the source that provides TS_TOKEN and AIZNT_PROXY_URLS. Treat prompts, request bodies, and any --body-file data as information intentionally sent to the configured image-generation service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill declares required environment variables and clearly relies on outbound API calls, but it does not declare explicit permissions for env and network access. Missing permission declarations weaken review and enforcement boundaries, making it easier for a skill to access secrets or external endpoints without transparent authorization metadata.

VirusTotal

64/64 vendors flagged this skill as clean.