Security audit
Security checks across malware telemetry and agentic risk
This is a real image-generation and cutting tool, but its local web server exposes broad unauthenticated file, admin, credential, and shutdown controls.
Review before installing. Run it only on a trusted local machine, keep the server bound to localhost and away from untrusted networks, use limited AceData credentials, and avoid sensitive images or prompts until authentication/CSRF checks are added, arbitrary file serving is removed, path handling is confined to an app workspace, and secrets are protected.
cmd.extend(['-out', out])
# 执行裁剪命令
result = subprocess.run(cmd, capture_output=True, text=True, encoding='utf-8')
if result.returncode == 0:
return jsonify({ext = 'png'
main_path = os.path.join(save_dir, f'main.{ext}')
img_response = requests.get(image_url, stream=True, timeout=60)
img_response.raise_for_status()
with open(main_path, 'wb') as f:
for chunk in img_response.iter_content(chunk_size=8192):ext = 'png'
main_path = os.path.join(save_dir, f'main.{ext}')
img_response = requests.get(image_url, stream=True, timeout=60)
img_response.raise_for_status()
with open(main_path, 'wb') as f:
for chunk in img_response.iter_content(chunk_size=8192):files = {
"file": open(file_path, "rb")
}
response = requests.post(UPLOAD_URL, headers=headers, files=files, timeout=60)
response.raise_for_status()
result = response.json()
url = result.get('url')65/65 vendors flagged this skill as clean.
No suspicious patterns detected.