Trust Assessment
aimlapi-media-gen received a trust score of 51/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 6 findings: 0 critical, 4 high, 2 medium, and 0 low severity. Key findings include Suspicious import: urllib.request, Arbitrary File Write via Path Traversal in Output Directory, Arbitrary File Write via Path Traversal in Output File Extension.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Arbitrary File Write via Path Traversal in Output Directory The `gen_image.py` script allows users to specify an output directory via the `--out-dir` argument. This argument is directly used to construct a `pathlib.Path` object and create directories. An attacker can provide a path traversal sequence (e.g., `../../../tmp`) to write generated image files to arbitrary locations on the filesystem, potentially overwriting critical files or placing malicious content in sensitive directories. While `pathlib` offers some sanitization, it does not prevent `../` from traversing directories. Sanitize the `--out-dir` argument to prevent path traversal. Ensure the resolved path is strictly within an allowed base directory. For example, resolve the path using `pathlib.Path(base_safe_dir).joinpath(user_input_dir).resolve()` and verify it starts with `base_safe_dir`. | LLM | scripts/gen_image.py:34 | |
| HIGH | Arbitrary File Write via Path Traversal in Output File Extension The `gen_image.py` script allows users to specify an output file format/extension via the `--output-format` argument. This argument is directly appended to the filename. If an attacker provides a path traversal sequence (e.g., `../../malicious.sh`) as the extension, it could lead to writing files to arbitrary locations outside the intended output directory, potentially leading to remote code execution if the file is placed in an executable context. Sanitize the `--output-format` argument. Only allow alphanumeric characters and a limited set of safe file extensions. Do not allow path separators or special characters that could manipulate the file path. | LLM | scripts/gen_image.py:37 | |
| HIGH | Arbitrary File Write via Path Traversal in Output Directory The `gen_video.py` script allows users to specify an output directory via the `--out-dir` argument. This argument is directly used to construct a `pathlib.Path` object and create directories. An attacker can provide a path traversal sequence (e.g., `../../../tmp`) to write generated video files to arbitrary locations on the filesystem, potentially overwriting critical files or placing malicious content in sensitive directories. While `pathlib` offers some sanitization, it does not prevent `../` from traversing directories. Sanitize the `--out-dir` argument to prevent path traversal. Ensure the resolved path is strictly within an allowed base directory. For example, resolve the path using `pathlib.Path(base_safe_dir).joinpath(user_input_dir).resolve()` and verify it starts with `base_safe_dir`. | LLM | scripts/gen_video.py:34 | |
| HIGH | Arbitrary File Write via Path Traversal in Output File Extension The `gen_video.py` script allows users to specify an output file extension via the `--output-extension` argument. This argument is directly appended to the filename. If an attacker provides a path traversal sequence (e.g., `../../malicious.sh`) as the extension, it could lead to writing files to arbitrary locations outside the intended output directory, potentially leading to remote code execution if the file is placed in an executable context. Sanitize the `--output-extension` argument. Only allow alphanumeric characters and a limited set of safe file extensions. Do not allow path separators or special characters that could manipulate the file path. | LLM | scripts/gen_video.py:37 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/d1m7asis/aimlapi-media-gen/scripts/gen_image.py:8 | |
| MEDIUM | Suspicious import: urllib.request Import of 'urllib.request' detected. This module provides network or low-level system access. Verify this import is necessary. Network and system modules in skill code may indicate data exfiltration. | Static | skills/d1m7asis/aimlapi-media-gen/scripts/gen_video.py:8 |
Scan History
Embed Code
[](https://skillshield.io/report/b068805571bee119)
Powered by SkillShield