Security risk report for @forgecat/openai_skills_imagegen v0.0.11
Source Integrity
Low
Profile is attributed to OpenAI with a public GitHub repository link and Apache-2.0 license.
Commit hash and timestamp are provided for traceability.
No evidence of typosquatting, obfuscated dependencies, or supply-chain manipulation.
Agent Intent
Low
Content is instructional documentation for a legitimate image-generation skill; it describes workflows, modes, and best practices without attempting to manipulate the AI into unauthorized actions.
No instructions to read credentials, exfiltrate data, ignore system prompts, or install remote payloads.
Guidance on prompting, file handling, and CLI usage is transparent and security-conscious (e.g., 'Never modify scripts/image_gen.py', 'Do not create one-off runners', 'preserve invariants aggressively').
References to network access and approval policies are presented as safety considerations, not as instructions to bypass them.
Details
Evidence
SKILL.md: 'Never modify `scripts/image_gen.py`. If something is missing, ask the user before doing anything else.'
cli.md: 'Do **not** create one-off runners (for example `gen_images.py`) unless the user explicitly asks for a custom wrapper.'
codex-network.md: 'Enabling network and reducing approvals lowers friction, but increases risk if you run untrusted code or work in an untrusted repository.'
Permissions
Low
The skill declares no tools or MCP servers; it relies on a built-in `image_gen` tool (default) or an optional fallback CLI script.
The built-in tool is scoped to image generation/editing only, matching the stated purpose.
The fallback CLI (`scripts/image_gen.py`) requires explicit user opt-in and is documented to need `OPENAI_API_KEY` + network access; it does not demand excessive filesystem or shell authority beyond what is necessary for image I/O.
File operations are constrained to documented paths (`output/imagegen/`, `tmp/imagegen/`, `$CODEX_HOME/generated_images/`) with clear guidance on non-destructive saves and versioning.
Details
Evidence
SKILL.md: 'Use the built-in `image_gen` tool by default for all normal image generation and editing requests. Never switch to CLI fallback automatically.'
cli.md: 'Use `tmp/imagegen/` for temporary JSONL inputs or scratch files. Use `output/imagegen/` for final outputs.'
SKILL.md: 'Do not overwrite an existing asset unless the user explicitly asked for replacement; otherwise create a sibling versioned filename such as `hero-v2.png`.'
MCP Risk
Low
No MCP servers are declared in the profile.
The fallback CLI script (`scripts/image_gen.py`) is bundled and documented; it is not an arbitrary remote binary.
Network access is gated by Codex sandbox configuration and approval policies; the profile does not attempt to bypass these controls.
Details
Evidence
Profile declares: '(none)' for MCP servers.
cli.md: 'Use the bundled CLI directly (`python "$IMAGE_GEN" ...`) after activating the correct environment.'
codex-network.md: '`--ask-for-approval never` suppresses approval prompts. It does **not** by itself enable network access.'
ForgeCat