Trust Assessment
gpt-image-1-5 received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 15 findings: 7 critical, 8 high, 0 medium, and 0 low severity. Key findings include File read + network send exfiltration, Sensitive path access: AI agent config, Potential Command Injection via unsanitized user inputs to script arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 0/100, indicating areas for improvement.
Last analyzed on June 1, 2026 (commit 9b0e00ad). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings15
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:15 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:20 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:25 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:121 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:126 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:131 | |
| CRITICAL | File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality. | Manifest | plugins/gpt-image-1-5/skills/SKILL.md:136 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:15 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:20 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:25 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:121 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:126 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:131 | |
| HIGH | Sensitive path access: AI agent config Access to AI agent config path detected: '~/.claude/'. This may indicate credential theft. Verify that access to this sensitive path is justified and declared. | Static | plugins/gpt-image-1-5/skills/SKILL.md:136 | |
| HIGH | Potential Command Injection via unsanitized user inputs to script arguments The skill's `SKILL.md` describes invoking a Python script (`generate_image.py`) via `uv run` with several user-controlled arguments, including `--prompt`, `--filename`, `--input-image`, and `--mask`. If the `generate_image.py` script does not properly sanitize or escape these arguments before using them in internal shell commands (e.g., `subprocess.run(shell=True)`), an attacker could inject arbitrary commands. For instance, a malicious `--filename` like `"; rm -rf /; #.png"` could lead to arbitrary code execution on the host system. The `generate_image.py` script must ensure all user-provided arguments are properly sanitized and escaped before being used in any shell commands. The safest approach is to avoid `shell=True` when using `subprocess.run()` and instead pass arguments as a list (e.g., `subprocess.run(['command', 'arg1', 'arg2'])`), which prevents shell interpretation. If `shell=True` is strictly necessary, implement robust escaping for all user-controlled parts of the command string. | LLM | SKILL.md:14 |
Scan History
Embed Code
[](https://skillshield.io/report/839ff1cc0d14e084)
Powered by SkillShield