ai-image-generation

Name: skills/ai-image-generation
Author: halt-catch-fire

Share on X Share on LinkedIn Share on Bluesky

40Medium

The skill impersonates a known brand and executes unpinned npx packages at runtime, creating a significant supply chain risk by allowing arbitrary code execution from the latest npm versions.

ThreatsCI SM CS BC S HITL

Threat Analysis

AI Agent Traps ↗Scanned 7/5/2026

Content InjectionPerceptionclean

Semantic ManipulationReasoning1 finding

Cognitive StateMemory & Learning1 finding

Behavioural ControlActionclean

SystemicMulti-Agent Dynamicsclean

Human-in-the-LoopHuman Overseerclean

Skill Info

Namehalt-catch-fire/skills/ai-image-generation

Registrygithub

Version601a457f7ecf

PURLpkg:github/halt-catch-fire/skills@601a457f7ecf?skill=ai-image-generation

Stars584

Installs351,300

Source

Repository ↗SKILL.md ↗

SHA-25658ff981bd982...

SHA-1a30317a36d76...

MD5b1093b7f3cb7...

TLSH94b183778c56...

ssdeep96:FdQrwMJxo...

Size5,291 bytes

Install

This skill has findings worth reviewing before installing.

GitHub

351,300 installs

Skills.shDocs

npx skills add https://github.com/halt-catch-fire/skills

Assessments (3)

AI Agent Traps ↗

Potential brand impersonationmediumsocial engineeringAML.T0052.000LLM09:2025

Skill name or description references a well-known AI brand, which may suggest impersonation.

70% confidence

openai

Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtimemediumsupply chainAML.T0010AML.T0019AML.T0058LLM03:2025

Unpinned npx package execution — `npx <pkg>` without a version pin pulls latest from npm at runtime (seen 9 times in this file at lines 7, 140, 143, 146, 149, 152, 155, 158, 161)

95% confidenceline 7

npx skills

Missing licenseinfopolicy violation

Skill does not specify a license field. Specifying a license helps users understand usage terms.

100% confidence

Badge

Markdown

[![Mondoo Skill Check](https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/ai-image-generation.svg)](https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/ai-image-generation)

HTML

<a href="https://mondoo.com/ai-agent-security/skills/github/halt-catch-fire/skills/ai-image-generation"><img src="https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/ai-image-generation.svg" alt="Mondoo Skill Check" /></a>

Image URL

https://mondoo.com/ai-agent-security/api/badge/github/halt-catch-fire/skills/ai-image-generation.svg

Secure your AI agents

Skills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.

Continuous scanning of skills across all registries
Policy enforcement before skills reach your agents
Integration with your existing security workflow