Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward image style-transfer API integration, with the main consideration being that user-provided image URLs are sent to a third-party service.
Install only if you are comfortable sending the reference and target image URLs to ngmob.com for processing. Avoid submitting private, sensitive, or access-controlled images unless you understand the provider's handling and retention practices.
The skill instructs the operator to submit user-supplied image URLs to a third-party API without any privacy, consent, retention, or data-handling warning. Even if only URLs are sent, the external service can fetch and process the referenced images, which may expose private or sensitive user content to an unvetted external processor.
The base URL match at the same line reflects the same external transmission event rather than a distinct additional issue. It is still a valid concern because it confirms reliance on an external API endpoint for handling user-provided content.
"Image Input": "https://example.com/reference-style.png",
"Image Input 1": "https://example.com/target-photo.png"
}
}' | curl -X POST https://api.ngmob.com/api/v1/workflows/Awtk0EnhqBGkoOExvseI/run \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d @-
The base URL match at the same line reflects the same external transmission event rather than a distinct additional issue. It is still a valid concern because it confirms reliance on an external API endpoint for handling user-provided content.
"Image Input": "https://example.com/reference-style.png",
"Image Input 1": "https://example.com/target-photo.png"
}
}' | curl -X POST https://api.ngmob.com/api/v1/workflows/Awtk0EnhqBGkoOExvseI/run \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d @-
The skill accepts user-supplied image URLs and transmits them to a third-party API for processing, but the manifest provides no user-facing disclosure about external sharing, retention, or privacy implications. Because images may contain sensitive personal data or internal URLs, this creates a real privacy and data-handling risk even if the transmission is necessary for functionality.
The manifest is configured to send request data to an external service at api.ngmob.com, which means user-provided image references leave the local trust boundary. In an image-processing skill this may be functionally required, but without explicit transparency, validation, or data-governance controls, external transmission of user content is still a security and privacy concern.
"author": "your-name",
"type": "api",
"category": "image-generation",
"endpoint": "https://api.ngmob.com/api/v1/workflows/Awtk0EnhqBGkoOExvseI/run",
"method": "POST",
"headers": {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
],
"polling": {
"enabled": true,
"url": "https://api.ngmob.com/api/v1/workflows/executions/{{task_id}}",
"method": "GET",
"headers": {
"Authorization": "Bearer {{API_KEY}}"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
],
"polling": {
"enabled": true,
"url": "https://api.ngmob.com/api/v1/workflows/executions/{{task_id}}",
"method": "GET",
"headers": {
"Authorization": "Bearer {{API_KEY}}"
The README instructs users to upload personal photos for AI transformation but provides no notice about privacy, retention, sharing, or third-party processing. While this is not an exploit in itself, it can mislead users into submitting sensitive images without informed consent, increasing privacy and compliance risk.
No suspicious patterns detected.