baoyu-image-gen

Mostly coherent image-generation skill with normal local config and API-key usage. The main concern is support for xheai/custom base URLs, which can route prompts, images, and credentials through third-party endpoints despite the skill presenting itself as official API-based; runtime bun fetch is a secondary low/medium supply-chain risk.

The code appears intended to generate images through an external API, but its default host is xheai.cc and receives the configured API key and prompt. Confirm that this provider is trusted before use. The unvalidated response URL fetch also presents an SSRF risk in server-side environments. No clear malware behavior is evident in this fragment.

The code implements expected Google image-generation API calls. No clear malicious behavior is evident. The curl proxy path has a concrete shell-command injection and credential-exposure risk because environment-controlled strings are interpolated into execSync's shell command. The configurable API base URL can also redirect credential-bearing requests if misconfigured or controlled by an attacker.