AI Hairstyle Generator

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:24 PM UTC
• Version:
  1.0.1

Overview

This skill is a straightforward Media.io hairstyle-generation API wrapper, with the main user consideration being that portrait image URLs are sent to Media.io for processing.

Install this if you are comfortable using a Media.io API key and sending user-authorized portrait image URLs to Media.io. Avoid private, sensitive, or unauthorized images, treat generated preview URLs as potentially shareable links, and keep the API key out of chat logs and responses.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill clearly instructs sending user-supplied image URLs to Media.io, but it does not explicitly warn that user images and related metadata will be transmitted to an external third-party service for processing. This creates a privacy and consent risk, especially for portraits and other sensitive images, because users may not realize their content leaves the local agent environment.

VirusTotal

66/66 vendors flagged this skill as clean.