Security audit
Security checks for vulnerabilities and agentic risk
This skill coherently sends user-provided clothing image URLs to a disclosed external virtual try-on API to generate product photos.
Install only if you are comfortable sending the clothing image URLs you provide to api.ngmob.com for processing. Avoid private, access-controlled, signed, confidential, or regulated image URLs unless you have authorization and accept the provider's data handling.
The skill instructs users to send clothing image URLs to a third-party API but does not clearly warn that user-provided images and URLs are transmitted off-platform for external processing. This can lead to privacy, confidentiality, and compliance issues if users provide proprietary product images, pre-release designs, or personal images without informed consent.
The hardcoded external endpoint indicates that workflow execution depends on a third-party service outside the platform's trust boundary. If users provide internal, confidential, or access-controlled image links, those references may be exposed to the external provider and could enable unauthorized retrieval or retention of sensitive assets.
curl -X POST https://api.ngmob.com/api/v1/workflows/2IIk3Z6NKuPZP7moonEI/run \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
The hardcoded external endpoint indicates that workflow execution depends on a third-party service outside the platform's trust boundary. If users provide internal, confidential, or access-controlled image links, those references may be exposed to the external provider and could enable unauthorized retrieval or retention of sensitive assets.
curl -X POST https://api.ngmob.com/api/v1/workflows/2IIk3Z6NKuPZP7moonEI/run \
-H "Authorization: Bearer $API_KEY" \
-H "Content-Type: application/json" \
-d '{
The manifest transmits user-supplied clothing image URLs to a third-party API, but the skill description and schema do not disclose that user data will be sent off-platform. Even if the inputs are described as publicly accessible URLs, they can still reveal business-sensitive assets, user intent, or link to infrastructure the user controls, creating a privacy and data-handling risk.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"author": "your-name",
"type": "api",
"category": "image-generation",
"endpoint": "https://api.ngmob.com/api/v1/workflows/2IIk3Z6NKuPZP7moonEI/run",
"method": "POST",
"headers": {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"author": "your-name",
"type": "api",
"category": "image-generation",
"endpoint": "https://api.ngmob.com/api/v1/workflows/2IIk3Z6NKuPZP7moonEI/run",
"method": "POST",
"headers": {
"Content-Type": "application/json",
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
"author": "your-name",
"type": "api",
"category": "image-generation",
"endpoint": "https://api.ngmob.com/api/v1/workflows/2IIk3Z6NKuPZP7moonEI/run",
"method": "POST",
"headers": {
"Content-Type": "application/json",
No suspicious patterns detected.