flux-2-klein

Global/unverified dependency execution — global npm/yarn package, dotnet tool, or auto-confirmed npx run without version or integrity pinning

npm i -g

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.

The skill accepts external image URLs for style transfer/composition. These images are processed by the remote model server, which may be susceptible to 'indirect prompt injection' via steganographic payloads or adversarial visual patterns embedded in the reference images.

Treat external URLs as untrusted; image-based prompt injection is a known risk