skills/freestylefly/canghe-skills/canghe-image-gen/Socket

canghe-image-gen

Warn

Audited by Socket on Sep 17, 2026

1 alert found:

Security

SecuritySKILL.md

MEDIUM

SecurityMEDIUM

SKILL.md

SUSPICIOUS. The core image-generation purpose is plausible, but the skill undermines its 'official API-based' framing by supporting a third-party gateway and arbitrary custom base URLs that can reroute prompts, images, and API keys away from official provider endpoints. Supply-chain risk from `npx -y bun` is moderate but secondary.

Confidence: 91%Severity: 74%

Audit Metadata

Analyzed At

Sep 17, 2026, 02:46 AM

Package URL

pkg:socket/skills-sh/freestylefly%2Fcanghe-skills%2Fcanghe-image-gen%2F@98cd9db43f49e0d998e8cc9f30beb164db6bbe7986be8638d01e60e490d69fd1