gpt-image-playground
Fail
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADS
Full Analysis
- [CREDENTIALS_UNSAFE]: The documentation explicitly encourages users to pre-fill settings, including OpenAI API keys, via URL query parameters (e.g.,
?apiKey=sk-xxxx). This is a significant security risk as API keys in URLs are captured in browser history, proxy/server logs, and can be leaked to external sites through theRefererheader. - [EXTERNAL_DOWNLOADS]: The skill provides instructions to clone and execute code from an unverified third-party GitHub repository (
https://github.com/CookSleep/gpt_image_playground.git) and a Docker image from a non-verified registry (ghcr.io/cooksleep/gpt_image_playground:latest). This introduces supply chain risks as the integrity of the code at these locations cannot be guaranteed.
Recommendations
- AI detected serious security threats
Audit Metadata