Is rednote-images@1.0.6 safe to install?

rednote-images@1.0.6

VERIFIED· install only

Publisher claims: "Generate RedNote image series with structured style and layout choices and bundled generation tooling. Use when the user asks to create RedNote image cards,..." Observed in sandbox: reads credential files.

Registry ClawHubPublisher 632657122 · publishing for 239 daysInstalls 689Last detonated 32 min ago

$clawhub install rednote-images

Watch Report an issue

Coverage

Install scripts ran; no agent task scenario for this bundle.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-15 and scored it 82/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: reads credential files.

Behavior trace

Honeypot run · 3 s · 2 scenarios

t+CategoryObserved action

0.0sprocessinstall script run in the sandbox

1.0sprocessexec /app/apps/web/node_modules/.bin/npm

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

1.0sprocessexec /app/node_modules/.bin/npm

1.0sprocessexec /pnpm/npm

1.0sprocessexec /usr/local/sbin/npm

1.0sprocessexec /usr/local/bin/npm

1.0sprocessexec /app/apps/web/node_modules/.bin/bun

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/bun

1.0sprocessexec /app/node_modules/.bin/bun

1.0sprocessexec /pnpm/bun

1.0sprocessexec /usr/local/sbin/bun

1.0sprocessexec /usr/local/bin/bun

1.0sprocessexec /usr/sbin/bun

1.0sprocessexec /usr/bin/bun

1.0sprocessexec /sbin/bun

1.0sprocessexec /bin/bun

1.0sprocessexec /app/apps/web/node_modules/.bin/npx

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npx

1.0sprocessexec /app/node_modules/.bin/npx

1.0sprocessexec /pnpm/npx

1.0sprocessexec /usr/local/sbin/npx

1.0sprocessexec /usr/local/bin/npx

1.0sprocessexec /app/apps/web/node_modules/.bin/sips

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/sips

1.0sprocessexec /app/node_modules/.bin/sips

1.0sprocessexec /pnpm/sips

1.0sprocessexec /usr/local/sbin/sips

1.0sprocessexec /usr/local/bin/sips

1.0sprocessexec /usr/sbin/sips

1.0sprocessexec /usr/bin/sips

1.0sprocessexec /sbin/sips

1.0sprocessexec /bin/sips

1.0sprocessexec /app/apps/web/node_modules/.bin/cwebp

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/cwebp

1.0sprocessexec /app/node_modules/.bin/cwebp

1.0sprocessexec /pnpm/cwebp

1.0sprocessexec /usr/local/sbin/cwebp

1.0sprocessexec /usr/local/bin/cwebp

1.0sprocessexec /usr/sbin/cwebp

1.0sprocessexec /usr/bin/cwebp

1.0sprocessexec /sbin/cwebp

1.0sprocessexec /bin/cwebp

1.0sprocessexec /app/apps/web/node_modules/.bin/magick

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/magick

1.0sprocessexec /app/node_modules/.bin/magick

1.0sprocessexec /pnpm/magick

1.0sprocessexec /usr/local/sbin/magick

1.0sprocessexec /usr/local/bin/magick

1.0sprocessexec /usr/sbin/magick

1.0sprocessexec /usr/bin/magick

1.0sprocessexec /sbin/magick

1.0sprocessexec /bin/magick

1.0sprocessexec /app/apps/web/node_modules/.bin/convert

1.0sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/convert

1.0sprocessexec /app/node_modules/.bin/convert

1.0sprocessexec /pnpm/convert

1.0sprocessexec /usr/local/sbin/convert

1.0sprocessexec /usr/local/bin/convert

1.0sprocessexec /usr/sbin/convert

1.0sprocessexec /usr/bin/convert

1.0sprocessexec /sbin/convert

1.0sprocessexec /bin/convert

1.0sprocessscript backend runs setup only

1.5sprocesssecond launch, clock +45 days, CI unset

2.5sfilesystemread ~/.npmrc

2.5sprocessexec /app/apps/web/node_modules/.bin/npm

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

2.5sprocessexec /app/node_modules/.bin/npm

2.5sprocessexec /pnpm/npm

2.5sprocessexec /usr/local/sbin/npm

2.5sprocessexec /usr/local/bin/npm

2.5sprocessexec /app/apps/web/node_modules/.bin/bun

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/bun

2.5sprocessexec /app/node_modules/.bin/bun

2.5sprocessexec /pnpm/bun

2.5sprocessexec /usr/local/sbin/bun

2.5sprocessexec /usr/local/bin/bun

2.5sprocessexec /usr/sbin/bun

2.5sprocessexec /usr/bin/bun

2.5sprocessexec /sbin/bun

2.5sprocessexec /bin/bun

2.5sprocessexec /app/apps/web/node_modules/.bin/npx

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npx

2.5sprocessexec /app/node_modules/.bin/npx

2.5sprocessexec /pnpm/npx

2.5sprocessexec /usr/local/sbin/npx

2.5sprocessexec /usr/local/bin/npx

2.5sprocessexec /app/apps/web/node_modules/.bin/sips

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/sips

2.5sprocessexec /app/node_modules/.bin/sips

2.5sprocessexec /pnpm/sips

2.5sprocessexec /usr/local/sbin/sips

2.5sprocessexec /usr/local/bin/sips

2.5sprocessexec /usr/sbin/sips

2.5sprocessexec /usr/bin/sips

2.5sprocessexec /sbin/sips

2.5sprocessexec /bin/sips

2.5sprocessexec /app/apps/web/node_modules/.bin/cwebp

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/cwebp

2.5sprocessexec /app/node_modules/.bin/cwebp

2.5sprocessexec /pnpm/cwebp

2.5sprocessexec /usr/local/sbin/cwebp

2.5sprocessexec /usr/local/bin/cwebp

2.5sprocessexec /usr/sbin/cwebp

2.5sprocessexec /usr/bin/cwebp

2.5sprocessexec /sbin/cwebp

2.5sprocessexec /bin/cwebp

2.5sprocessexec /app/apps/web/node_modules/.bin/magick

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/magick

2.5sprocessexec /app/node_modules/.bin/magick

2.5sprocessexec /pnpm/magick

2.5sprocessexec /usr/local/sbin/magick

2.5sprocessexec /usr/local/bin/magick

2.5sprocessexec /usr/sbin/magick

2.5sprocessexec /usr/bin/magick

2.5sprocessexec /sbin/magick

2.5sprocessexec /bin/magick

2.5sprocessexec /app/apps/web/node_modules/.bin/convert

2.5sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/convert

2.5sprocessexec /app/node_modules/.bin/convert

2.5sprocessexec /pnpm/convert

2.5sprocessexec /usr/local/sbin/convert

2.5sprocessexec /usr/local/bin/convert

2.5sprocessexec /usr/sbin/convert

2.5sprocessexec /usr/bin/convert

2.5sprocessexec /sbin/convert

2.5sprocessexec /bin/convert

Static findings

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/main.ts:476 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...(await loadEnvFile(path.join(home, ".image-skills", SKILL_NAMESPACE, ".env"))),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/setup.mjs:33 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files1) Optionally writes IMAGE_GEN_API_KEY into the local skill .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagescripts/build-batch.ts:43 · npx invocation of non-well-known package — may execute untrusted codenpx -y bun scripts/build-batch.ts --prompts prompts --output batch.json --images-dir images [--model <model>]Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagepackage.json:17 · npx invocation of non-well-known package — may execute untrusted code"compress": "npx -y bun scripts/vendor/compression-runtime/scripts/main.ts",Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/main.ts:477 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files...(await loadEnvFile(path.join(projectRoot, ".image-skills", SKILL_NAMESPACE, ".env"))),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagepackage.json:15 · npx invocation of non-well-known package — may execute untrusted code"build-batch": "npx -y bun scripts/build-batch.ts",Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/setup.mjs:28 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files--scope <target> Where to write the local .env: project or home (default: project)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/doctor.mjs:214 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (!mark("gateway-api-key", hasApiKey, `Need IMAGE_GEN_API_KEY in env or .image-skills/${skillNamespace}/.env`)) {Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagepackage.json:14 · npx invocation of non-well-known package — may execute untrusted code"build-prompts": "npx -y bun scripts/build-prompts.ts",Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionscripts/build-prompts.ts:202 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Prompts written: ${outputDir} (${cards.length} files)`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagepackage.json:13 · npx invocation of non-well-known package — may execute untrusted code"scaffold": "npx -y bun scripts/scaffold.ts",Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/doctor.mjs:216 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

suggestions.push(`Provide IMAGE_GEN_API_KEY, then rerun \`npm run setup -- --project . --persist-api-key\` or write .image-skills/${skillNamespace}/.env`);

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/main.ts:403 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesreturn existsSync(path.join(baseDir, ".env")) || existsSync(path.join(baseDir, "EXTEND.md"));Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/doctor.mjs:284 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

suggestions.push(`Provide IMAGE_GEN_API_KEY, then rerun \`npm run setup -- --project . --persist-api-key\` or write .image-skills/${skillNamespace}/.env before using gateway generation`);

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsSKILL.md:245 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

… when the key is already in env, or persist it to `.image-skills/rednote-images/.env` on the user's behalf, then continue without leaving this workflow. When this …

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/setup.mjs:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst defaultEnvPath = `${defaultConfigDir}/.env`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/main.ts:58 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

…eys, then add it to the environment or project .image-skills/${SKILL_NAMESPACE}/.env. IMAGE_GEN_API_KEY is still accepted as a compatibility alias. If you are setti…

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagescripts/build-prompts.ts:35 · npx invocation of non-well-known package — may execute untrusted codenpx -y bun scripts/build-prompts.ts --outline outline.md --output-dir promptsFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/main.ts:577 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesAlso loaded: <project>/.image-skills/${SKILL_NAMESPACE}/.env and ~/.image-skills/${SKILL_NAMESPACE}/.envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/doctor.mjs:283 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system fileswarnings.push(`IMAGE_GEN_API_KEY was not detected in the environment or project .image-skills/${skillNamespace}/.env`);Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsscripts/vendor/shared-image-generation/scripts/doctor.mjs:90 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env");Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsSKILL.md:31 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

4. Add it to the required environment variable `IMAGE_GEN_API_KEY`, or let the setup flow persist it under `.image-skills/rednote-images/.env`.

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

File type combined with upload actionscripts/build-batch.ts:237 · File type combined with upload action — agent may exfiltrate local data files

console.log(`Batch file written: ${args.outputPath} (${tasks.length} tasks, model: ${resolvedModel.value} via ${resolvedModel.source})`);

Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/vendor/shared-image-generation/scripts/main.ts:1579 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(r.outputPath);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/vendor/shared-image-generation/scripts/build-visual-brief.mjs:294 · File type combined with upload action — agent may exfiltrate local data filesif (outputPath) console.log(`Brief written: ${outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagescripts/package.json:7 · npx invocation of non-well-known package — may execute untrusted code"test": "npx -y bun test"Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/scaffold.ts:22 · npx invocation of non-well-known package — may execute untrusted codenpx -y bun scripts/scaffold.ts --output-dir rednote-images/topic-slug --theme "Topic" [options]Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionscripts/scaffold.ts:220 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Scaffold created in: ${outputDir}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/vendor/shared-image-generation/scripts/discover-models.mjs:280 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Registry already exists (skipped): ${summary.outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

File type combined with upload actionscripts/vendor/shared-image-generation/scripts/build-visual-brief.mjs:291 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(JSON.stringify({ ...summary, outputPath }, null, 2));Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagescripts/vendor/shared-image-generation/scripts/package.json:7 · npx invocation of non-well-known package — may execute untrusted code"test": "npx -y bun test"Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionscripts/vendor/shared-image-generation/scripts/discover-models.mjs:283 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(`Wrote starter registry: ${summary.outputPath}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

npx invocation of non-well-known packagescripts/vendor/shared-image-generation/scripts/style-menu.mjs:51 · npx invocation of non-well-known package — may execute untrusted codeconsole.log(" npx -y bun scripts/main.ts \\");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

npx invocation of non-well-known packagescripts/vendor/shared-image-generation/scripts/doctor.mjs:279 · npx invocation of non-well-known package — may execute untrusted codeif (!hasBun && !hasNpx) errors.push("Need Bun or npx so Bun-based workflow scripts can run");Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

Cost to the agent

Instructions loaded

≈3,359 tok

2 files · 55 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.