3d Image Generator

• Outcome: Review
• Latest audit: May 28, 2026 · 7:38 AM UTC
• Version: 2026.3.23

Overview

This image-generation skill is mostly purpose-aligned, but it needs review because it can persist API keys and upload local reference images to a third-party service despite inconsistent disclosure.

Review before installing. Use it only if you are comfortable sending prompts and selected reference images to WeryAI, and prefer setting IMAGE_GEN_API_KEY through your environment or a managed secret store instead of letting the skill write a plaintext .env file. Avoid using sensitive local images as references unless you explicitly intend to upload them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (28)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly uses sensitive capabilities including network access and environment-based secret handling, yet it does not declare permissions. This weakens transparency and policy enforcement because a host system or reviewer may underestimate what the skill can access and do.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill is presented as a narrowly scoped 3D-image generator, but the documented behavior is much broader: general image generation, model discovery, web-search forwarding, batch processing, and other non-3D styles. This mismatch can mislead users and reviewers, causing them to grant trust or approval under false assumptions about scope and data flows.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The setup flow expands a narrowly described 3D image skill into a generic image-generation workspace that silently initializes models, registries, and persistent configuration. That scope creep is dangerous because it authorizes unrelated configuration changes and model selection behavior beyond the stated purpose, making it easier for the skill to alter project state in ways the user did not request or understand.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The file instructs the agent to obtain, persist, and manage an API key locally, including writing it into a project .env path. Secret handling is security-sensitive; normalizing automatic credential persistence for a content-generation skill increases the risk of accidental disclosure, insecure storage, and unauthorized reuse of the credential from the workspace.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script recursively finds package.json files and runs `npm install` in each target directory via `spawnSync`, which can execute arbitrary lifecycle scripts from dependencies. In a skill whose stated purpose is 3D image generation, a bootstrap installer is outside the core runtime function and expands the attack surface by enabling code execution during setup, especially if the repository or dependency tree is untrusted or modified.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The readiness script performs side-effecting setup beyond simple image generation: it may create project configuration and invoke bootstrap actions that can modify files under the skill or project context. For a skill advertised as 3D image generation, this broad project mutation capability is not clearly necessary and increases the risk of unexpected changes when the skill is used or installed.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The code inspects the user's project directory and may create a .image-skills/.../EXTEND.md configuration file, which is outside the narrow scope implied by a 3D art generation skill. Even if intended as convenience setup, project inspection and modification create unnecessary trust and attack surface because a graphics skill should not need to alter repository configuration automatically.

Context-Inappropriate Capability

Medium

• Confidence: 70% confidence
• Finding: The skill exposes `use_web_search` and forwards it to the external generation provider, which can cause user prompts and context to be augmented with internet-sourced data outside the skill's stated 3D-image purpose. In an agent setting, this expands data flow and may leak sensitive prompt content to additional retrieval systems or produce outputs influenced by untrusted web content.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The setup script accepts an API key from CLI or environment and persists it into a local or home-scoped .env file. That is sensitive-credential handling outside the narrow image-generation function, and storing secrets in project files increases risk of accidental disclosure through source control, backups, or other tooling that reads local config.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The file instructs the agent to go beyond its stated 3D image-generation purpose by checking environment readiness, handling API-key availability, and writing configuration/state into the workspace. Expanding a content-generation skill into credential and local setup management increases the attack surface and creates opportunities for unintended file writes or secret-handling mistakes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly directs the agent to persist an API key to a local `.env` file, which is a sensitive secret-management action not inherently required for producing 3D images. Local secret persistence can expose credentials through accidental commits, permissive file access, workspace leakage, or downstream tooling that reads project files.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill supports a `default_use_web_search` setting in its project/home configuration, enabling external-search augmentation that is outside the manifest’s narrow purpose of generating 3D images. This broadens data access and outbound network behavior without clear user-facing justification, increasing the chance of unintended data exposure or policy bypass through upstream search.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The CLI exposes `--use-web-search`, which adds an undeclared network-backed search capability beyond simple image generation. In an agent skill, such flags can be triggered by higher-level orchestration and cause the tool to fetch or derive content from external sources unrelated to the requested local rendering task.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code forwards `use_web_search` directly to the upstream API, turning a local image-generation wrapper into a conduit for external-search behavior. Because this occurs at request construction time, any caller that sets the flag can cause additional upstream data access not implied by the skill’s stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: This setup script performs side effects beyond the declared skill purpose by creating local configuration files and optionally persisting credentials. Even if intended for legitimate setup, writing project or home configuration increases the skill's ability to alter a user's environment and store secrets, which is risky for a skill presented as an image-generation capability.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script can write IMAGE_GEN_API_KEY into project-local or home-directory .env files, creating durable plaintext secret storage. This is dangerous because secrets may be unintentionally committed, exposed to other local processes, or left in broadly accessible locations unrelated to the narrow task of generating 3D images.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code reads sensitive credentials from process.env and uses HOME to decide where to store them, expanding access to and handling of secrets inside the skill setup flow. In the context of a graphics skill, this broadens the trust boundary unnecessarily and makes accidental secret exposure or persistence more likely.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to store an API key in a local .env file on the user's behalf without requiring a clear warning about persistence, local exposure, or multi-user machine risk. Persisting credentials silently or with incomplete disclosure increases the chance of accidental secret retention and unauthorized reuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This instruction directs the agent to write the API key to disk on the user's behalf without a clear, explicit warning about persistence in a local file. Writing secrets into workspace files can expose them to source control, backups, other local users, or later tool access if the storage location is not carefully protected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill tells the agent to silently create directories and write configuration files immediately, without upfront disclosure that project files will be modified. Silent file mutation is risky because it can change workspace behavior, overwrite user preferences, and erode trust by making durable changes outside the user's explicit request.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document explicitly defines sending prompts, images, and optional webhook data to an external third-party service but provides no user-consent, privacy notice, or data-handling constraints. In a 3D image generation skill, users may upload sensitive images or include confidential text prompts, so silent external transfer can expose personal, proprietary, or regulated data to the provider and related CDN/download infrastructure.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script writes a new EXTEND.md file automatically when one does not exist, without an interactive confirmation or prominent warning. While the content is static and not attacker-controlled here, silent configuration writes can surprise users, interfere with repositories, and normalize hidden side effects in a skill whose stated purpose is only image generation.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation explicitly states that the CLI can encode local files as `data:image/...;base64,...` and transmit them through the `images` field, but it does not include any user-facing privacy or consent warning. In an agent skill that may operate on local user-provided assets, this can lead to unintended exfiltration of sensitive local images or embedded metadata to a third-party API, especially if users do not realize local files are being uploaded off-device.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- If dependencies are missing: ask for approval to install them, then install silently
- If `IMAGE_GEN_API_KEY` is missing: tell the user image generation needs an API key and offer to configure it now by writing `.image-skills/3d-image-generator/.env` on the user's behalf
- Do not ask the user to debug the environment before this readiness gate runs
- Do not ask the user to choose a model before readiness and API key are resolved
- Treat API keys as secrets: prefer writing them locally on the user's behalf, never echo them back, and never include them in normal progress messages

**`EXTEND.md`** is optional and can hold default model, quality, aspect ratio, and batch worker limits.

• Confidence: 84% confidence
• Finding: This section instructs the agent to offer writing the API key into a local .env file and to proceed through setup decisions before broader user involvement. In context, the autonomy is risky because it combines secret handling and local configuration changes, which can lead to credential persistence without sufficiently informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

When the user wants image generation but no model is configured (`EXTEND.md`, `--model`, and `IMAGE_GEN_DEFAULT_MODEL` are all absent):

**Do not ask the user to read docs or edit config files.** Follow the guided flow in [references/config/first-time-setup.md](references/config/first-time-setup.md) § "Model Selection — Agent-Guided Flow":

1. Start from the bundled starter registry shipped with this skill. If the model list looks stale or a requested model is missing, refresh it silently with `npm run discover-image-models -- --out .image-skills/3d-image-generator/MODELS.json`
2. Initialize local defaults with **Nano Banana 2** (`GEMINI_3_1_FLASH_IMAGE`) by writing `EXTEND.md`

• Confidence: 80% confidence
• Finding: The skill directs the agent to silently refresh model registries and write EXTEND.md defaults without asking the user to manage configuration. While convenient, this is autonomous modification of local files and behavior, which can surprise users and weaken change-control in shared or sensitive environments.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/main.ts:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/run-generate.mjs:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/main.ts:47

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/main.ts:6

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:6