Agent Economy ReportAgent Economy ReportCAUTION version 1.0.1 · audited 2026-09-17
This skill is a command-line Python program that sends image prompts to an OpenAI-compatible Images API and saves the returned pictures as PNG files, along with prompts.json and a local index.html gallery. It reads an OpenAI API key from the OPENAI_API_KEY environment variable or a --api-key argument. The API address defaults to api.openai.com but can be redirected through OPENAI_BASE_URL or OPENAI_API_BASE. The script only writes into the output folder it creates and does not install software, add persistence, or touch wallets. It is not clearly malicious, but a careful user should review it because the configurable API base receives the key, and prompt text is placed into generated HTML without escaping.
Instructions try to steer the agent beyond the declared purpose. No package instructions were found that try to override an agent's rules. However, scripts/gen.py line 144 inserts prompt text directly into the generated index.html without HTML escaping, so a prompt containing HTML or JavaScript becomes active content in the generated gallery. The publisher's skill card acknowledges this at skill-card.md line 32.
| Declared purpose | Batch-generate images via OpenAI Images API. Random prompt sampler + `index.html` gallery. |
| Observed behavior | The package contains a Python CLI script, scripts/gen.py, that accepts options such as --count, --model, --size, --quality, --prompt, --out-dir, --api-key, and --dry-run. It builds prompts either randomly or from --prompt, determines the API URL from OPENAI_BASE_URL, OPENAI_API_BASE, or https://api.openai.com, sends HTTPS POST requests with a bearer key, decodes returned b64_json image data into PNG bytes, and writes PNG files, prompts.json, and index.html into an output directory. No subprocess execution, persistence logic, wallet access, or package installation behavior appears in the code. |
| Verdict, rules only | CAUTION · reads credential-like environment variables: OPENAI_API_KEY |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | Sends HTTPS POST requests to the image generation endpoint, defaulting to https://api.openai.com and overridable through OPENAI_BASE_URL or OPENAI_API_BASE. |
| credentials | needed | Reads OPENAI_API_KEY from the environment or --api-key and sends it in the Authorization header. |
| filesystem_write | needed | Creates the output directory and writes PNG images, prompts.json, and index.html. |
| shell | exceeds purpose | SKILL.md provides shell commands to run the Python script and open the generated gallery, but the script itself does not invoke a shell. |
| severity | finding |
|---|---|
| medium | API base URL can be overridden The image API endpoint is taken from OPENAI_BASE_URL or OPENAI_API_BASE when set, so the API key and prompts could be sent to a non-OpenAI host. The fallback is api.openai.com on line 37. scripts/gen.py:35 os.environ.get("OPENAI_BASE_URL") |
| info | Default network destination is api.openai.com The script defaults to the standard OpenAI API host when no override is present. scripts/gen.py:37 or "https://api.openai.com" |
| info | Sends API key as bearer token The OpenAI API key is included in the Authorization header for each image generation request. This is required for the declared purpose, but the destination depends on the configured API base. scripts/gen.py:103 "Authorization": f"Bearer {api_key}" |
| info | Reads OpenAI API key The credential is taken from either the --api-key argument or the OPENAI_API_KEY environment variable. scripts/gen.py:167 api_key = args.api_key or os.environ.get("OPENAI_API_KEY") |
| medium | Unescaped prompt content in generated HTML Prompt text is inserted into index.html without HTML escaping. A user-supplied prompt containing HTML or JavaScript would be written as active content into the generated gallery. scripts/gen.py:144 html.append(f"<pre>{it['prompt']}</pre>") |
| info | Writes generated HTML gallery The script creates index.html in the chosen output directory. scripts/gen.py:146 with open(os.path.join(out_dir, "index.html"), "w", encoding="utf-8") as f: |
| info | Writes decoded image bytes Decoded b64_json image data is written as PNG files in the output directory. scripts/gen.py:202 with open(path, "wb") as f: |
| info | Writes prompt mapping file The script saves a prompt-to-file mapping as prompts.json in the output directory. scripts/gen.py:218 with open(os.path.join(out_dir, "prompts.json"), "w", encoding="utf-8") as f: |
| info | Publisher discloses endpoint override risk This documented risk matches the behavior in scripts/gen.py lines 35-36. skill-card.md:24 Risk: The skill can send the OpenAI API key and prompts to a custom API endpoint if OPENAI_BASE_URL or OPENAI_API_BASE is set. |
| info | Publisher discloses HTML escaping issue This documented risk matches the unescaped prompt interpolation in scripts/gen.py line 144. skill-card.md:32 Risk: The generated local HTML gallery may include unescaped prompt content. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| api.openai.com | not in the service index | scripts/gen.py:37 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| Binaries invoked | base64, bash, python3 |
| Environment variables read | OPENAI_API_BASE, OPENAI_API_KEY, OPENAI_BASE_URL |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 12 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 35 | 10e0537c59f71511… |
_meta.json | 6 | c5cd54e588569925… |
scripts/gen.py | 227 | 4e2028a026652e59… |
skill-card.md | 56 | 7e03caab0e93b320… |
For agents
JSON: https://agenteconomy.report/k/openai-image-gen.audit.json · badge: https://agenteconomy.report/k/openai-image-gen.audited.svg ·
skill rating: /k/openai-image-gen · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).