install-kie-mcp

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes curl to upload files for image-to-image processing. This is a functional requirement for the KIE.ai service. The implementation securely passes authentication credentials via standard input (--config -) rather than command-line arguments to prevent the API key from appearing in system process lists.
  • [CREDENTIALS_UNSAFE]: The skill requests a KIE_API_KEY from the user. It explicitly instructs the user to add the configuration files (.mcp.json, .mcp-servers/) to .gitignore to prevent accidental credential leakage to public repositories. This follows security best practices for secret management.
  • [EXTERNAL_DOWNLOADS]: The skill fetches dependencies defined in requirements.txt (mcp[cli]>=1.2.0) using pip. These are standard, well-known libraries for the Model Context Protocol ecosystem.
  • [DATA_EXFILTRATION]: Network operations are restricted to communication with the official KIE.ai API (api.kie.ai) and their file upload endpoint (kieai.redpandaai.co). These are necessary for the skill's stated purpose of image generation.
  • [PROMPT_INJECTION]: The SKILL.md includes a safety disclaimer regarding scraped content, advising the agent to treat external data as untrusted and not as instructions, which aligns with safety best practices.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 03:50 PM