dreamina-cli-image2image

Fail

Audited by Gen Agent Trust Hub on Sep 30, 2026

Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file references/workflow-patterns.md contains instructions to execute cat ~/.dreamina_cli/config.toml. This command reads a configuration file that likely contains sensitive authentication tokens or session credentials for the Dreamina service, exposing them to the agent's context.
  • [DATA_EXFILTRATION]: By reading the sensitive configuration file ~/.dreamina_cli/config.toml into the agent's context, the skill creates an opportunity for credential theft or exfiltration to external entities.
  • [REMOTE_CODE_EXECUTION]: The skill provides instructions in references/workflow-patterns.md to download and execute an installation script from the official service domain using the pattern curl -fsSL https://jimeng.jianying.com/cli | bash. While targeting a legitimate domain, this pattern executes remote code directly in the host shell.
  • [EXTERNAL_DOWNLOADS]: Fetches and executes an installation script from the official Dreamina/Jimeng service domain (jimeng.jianying.com) using a piped shell command, and links to external configuration contracts on GitHub.
  • [COMMAND_EXECUTION]: The skill makes extensive use of the dreamina CLI tool across all provided examples and scripts, granting the agent capability to perform local file system operations and network-based image generation tasks.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Sep 30, 2026, 02:55 AM