hd-txt2img-v2L

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:16 PM UTC
• Version:
  1.0.0

Overview

This skill appears to do only the advertised Hidream image-generation API call, but users should understand their prompt and token are sent to Hidream.

Install only if you are comfortable sending image prompts to Hidream and using a Hidream bearer token with this script. Prefer the HIDREAM_AUTHORIZATION environment variable over putting real tokens directly in shell commands, and avoid confidential prompts unless Hidream's data handling is acceptable for your use case.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes a Python script that uses network access and accepts an authorization token, but the skill metadata does not declare the corresponding permissions or clearly signal those capabilities. This weakens user and platform trust boundaries because a caller may not realize the skill can transmit sensitive inputs to an external service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill documentation instructs users to provide an authorization token and prompt to a third-party API, but it does not warn that both are sent off-platform. This creates a real data-exposure risk because users may enter sensitive prompts or tokens without informed consent, especially when the skill is framed as a general image-generation helper.

VirusTotal

65/65 vendors flagged this skill as clean.