Claude Code, Skill
Bria Skill
Bria Skill has PlugVet grade C (One medium finding) from our automated hygiene checks. Finding: a package install hook (preinstall, install, postinstall or prepare) runs a script. This is a hygiene check, not a security audit or a guarantee. Graded on 20/10/2026.
Generate, edit, and precisely control images directly from your AI coding agent using Bria.ai's commercially-safe models.
Compatibility: Not stated.
Grade C
One Medium finding. Read the findings before installing.
Not a guarantee. A hygiene check of the source at the commit shown, not a security audit.
Rescanned at commit 3b8ce7ec5869.
INSTALL_LIFECYCLE_HOOK
Why this grade
- INSTALL_LIFECYCLE_HOOK Medium
A package install hook (preinstall, install, postinstall or prepare) runs a script.
package.json, line 95
prepare
Any High, or two or more Medium findings, give D. One Medium gives C. Low findings or a security Note give B. Each code names a finding behind the letter.
Grades are a hygiene check of the source at the commit shown, on the date checked, not a security audit or a guarantee. The free directory grades are automated. Before release, a PlugVet engineer reviews every paid report and any grade we hold back, including all F grades, against the source code and the evidence we quote.
What was checked
Plain notes from the hygiene checks.
Permissions
Concern
can delete files.
PERMISSION_DELETE_FILES
bin/cli.js, line 35
fs.rmSync(dir, { recursive: true, force: true });
Install and update
Concern
runs a script at install time.
INSTALL_LIFECYCLE_HOOK
package.json, line 95
prepare
Network
Concern
can reach a host that is not written as a fixed address. can reach engine.prod.bria-api.com. The description does not name that host.
NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST
bria-ai-openclaw/skills/automotive/SKILL.md, line 63
DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \
bria-ai-openclaw/skills/automotive/SKILL.md, line 84
TOKEN_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token" \
bria-ai-openclaw/skills/automotive/SKILL.md, line 107
INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
Show more
bria-ai-openclaw/skills/automotive/SKILL.md, line 207
curl -sL "$FINAL_URL" -o car_cold_night.jpg
bria-ai-openclaw/skills/automotive/SKILL.md, line 226
curl -sL "$FINAL" -o offroad.jpg
bria-ai-openclaw/skills/automotive/SKILL.md, line 239
curl -sL "$FINAL" -o showroom.jpg
bria-ai-openclaw/skills/automotive/references/code-examples/bria_client.sh, line 71
http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \
bria-ai-openclaw/skills/automotive/references/code-examples/bria_client.sh, line 104
poll=$(curl -s "$status_url" \
Secrets
Concern
reads a credential or environment file.
SECRETS_ENV_READ SECRETS_PATH_UNCONFIRMED
kiro/bria-ai/steering/bria-client-python.py, line 43
self.api_key = api_key or os.environ.get("BRIA_API_KEY")
kiro/bria-ai/steering/bria-client-typescript.ts, line 115
this.apiKey = apiKey || process.env.BRIA_API_KEY || "";
skills/bria-ai/references/code-examples/build_catalog.py, line 34
k = os.environ.get("BRIA_API_KEY")
Show more
.gitignore, line 14
*$py.class
Agent instructions
Pass
No instruction to ignore earlier instructions or to hide a step.
Obfuscation
Pass
No encoded or minified payload found.
Licence
Note
no licence file found.
LICENCE_MISSING
Maintainer activity
Pass
The latest commit is within the last 365 days.
Note
Hygiene check of commit 3b8ce7ec5869. can delete files. runs a script at install time. can reach a host that is not written as a fixed address. can reach engine.prod.bria-api.com. The description does not name that host. reads a credential or environment file. no licence file found.
Date and source
Date checked:
github.com
Commit graded: 3b8ce7ec5869d43efd5dd0f726e45e83b93b1b82
This link goes to the original host. PlugVet does not host or check what you download from there, and installing it is your own decision and risk.