Skills
Navigate
skills/xianyu110/ecommerce-image-skills/batch-background-swap/Gen Agent Trust Hub

batch-background-swap

Fail

Audited by Gen Agent Trust Hub on Oct 4, 2026

Risk Level: CRITICALDATA_EXFILTRATIONCREDENTIALS_UNSAFE
Full Analysis
  • [DATA_EXFILTRATION]: The file SKILL.md contains a link to https://chatgpt-plus.top/list/#/home, which has been identified as a phishing site by automated security scanners. The skill explicitly instructs users in certain regions to navigate to this site to use the service, posing a high risk of credential theft or further exploitation.
  • [CREDENTIALS_UNSAFE]: The documentation and Python scripts (generate.py, batch_edit.py) facilitate a 'Bring Your Own Key' (BYOK) model that encourages users to export a sensitive GPTIMAGE_API_KEY and route it through a third-party API gateway at https://tryallapi.com/v1. This intermediary service is not a well-known or trusted provider, potentially allowing for the interception and harvesting of user credentials.
  • [DATA_EXFILTRATION]: The skill uses scripts/online_link.py to generate tracking URLs that include prompt content and metadata sent to https://gptimage2.asia. This results in the transmission of potentially sensitive product descriptions and internal workflow metadata to an external, untrusted domain.
Recommendations
  • AI detected serious security threats
  • Contains 1 malicious URL(s) - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Oct 4, 2026, 12:09 PM