Security Audit

jimliu/baoyu-skills:skills/baoyu-image-gen

github.com/jimliu/baoyu-skills

AI SkillCommit 6b7a2e417500

CRITICAL

Scanned 24 days ago

Critical

Immediate action required

High

Priority fixes suggested

Medium

Best practices review

Low

Acknowledged / Tracked

Trust Assessment

jimliu/baoyu-skills:skills/baoyu-image-gen received a trust score of 35/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.

SkillShield's automated analysis identified 3 findings: 2 critical, 0 high, 1 medium, and 0 low severity. Key findings include File read + network send exfiltration, Sensitive environment variable access: $HOME, Prompt Injection leading to Arbitrary Command Execution via Codex CLI.

The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.

Last analyzed on August 6, 2026 (commit 6b7a2e41). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.

Layer Breakdown

Manifest Analysis

70%

Static Code Analysis

93%

Dependency Graph

100%

LLM Behavioral Safety

70%

Behavioral Risk Signals

Network Access

1 finding

Filesystem Write

1 finding

Shell Execution

2 findings

Dynamic Code

1 finding

Excessive Permissions

3 findings

Security Findings3

Severity	Finding	Layer	Location
CRITICAL	File read + network send exfiltration AI agent config/credential file access Remove access to sensitive files not required by the skill's stated purpose. SSH keys, cloud credentials, and browser data should never be read by skills unless explicitly part of their declared functionality.	Manifest	skills/baoyu-image-gen/scripts/codex-imagegen/spawn.ts:20
CRITICAL	Prompt Injection leading to Arbitrary Command Execution via Codex CLI The `codex-cli` provider interpolates untrusted user prompts directly into the instruction payload sent to `codex exec --sandbox danger-full-access`. Since the Codex agent has access to a command execution tool ('shell') and runs with full access to the host system, an attacker can craft a prompt that manipulates the Codex LLM into executing arbitrary shell commands on the host system. Avoid running the Codex agent with `--sandbox danger-full-access` when processing untrusted user prompts. If full access is required, implement strict prompt validation, or use a secure, isolated sandbox environment where command execution cannot affect the host system. Alternatively, do not allow arbitrary user prompts to be executed via agent-based command execution tools.	LLM	scripts/codex-imagegen/main.ts:115
MEDIUM	Sensitive environment variable access: $HOME Access to sensitive environment variable '$HOME' detected in shell context. Verify this environment variable access is necessary and the value is not exfiltrated.	Static	skills/baoyu-image-gen/SKILL.md:29

Scan History

Embed Code

[![SkillShield](https://skillshield.io/api/v1/badge/40502738199a3db1.svg)](https://skillshield.io/report/40502738199a3db1)