dreamina-cli-image2image
Fail
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONREMOTE_CODE_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
references/workflow-patterns.mdcontains instructions to executecat ~/.dreamina_cli/config.toml. This command reads a configuration file that likely contains sensitive authentication tokens or session credentials for the Dreamina service, exposing them to the agent's context. - [DATA_EXFILTRATION]: By reading the sensitive configuration file
~/.dreamina_cli/config.tomlinto the agent's context, the skill creates an opportunity for credential theft or exfiltration to external entities. - [REMOTE_CODE_EXECUTION]: The skill provides instructions in
references/workflow-patterns.mdto download and execute an installation script from the official service domain using the patterncurl -fsSL https://jimeng.jianying.com/cli | bash. While targeting a legitimate domain, this pattern executes remote code directly in the host shell. - [EXTERNAL_DOWNLOADS]: Fetches and executes an installation script from the official Dreamina/Jimeng service domain (
jimeng.jianying.com) using a piped shell command, and links to external configuration contracts on GitHub. - [COMMAND_EXECUTION]: The skill makes extensive use of the
dreaminaCLI tool across all provided examples and scripts, granting the agent capability to perform local file system operations and network-based image generation tasks.
Recommendations
- AI detected serious security threats
Audit Metadata