OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
This skill provides image generation and editing capabilities using the Gemini API. While the core functionality is legitimate, it is susceptible to indirect prompt injection because it processes external image files and has the capability to write to the local filesystem. Additionally, it encourages insecure API key handling via command-line arguments.
Detected behaviors
No alerts
No issues
1/2 files flagged
Score: 93/100 · 2 sections analyzed