Avatar Image Generator

• Outcome: Review
• Latest audit: May 28, 2026 · 7:39 AM UTC
• Version: 1.0.1

Overview

This avatar tool connects to an image-generation API, but it includes broader image-generation, local file upload, callback, web-search, and credential-storage behavior than an avatar-only skill clearly needs.

Install only if you are comfortable with a broad WeryAI-backed image-generation tool, not a tightly limited avatar-only helper. Do not use private photos or local file references unless you intend to upload them to the provider, avoid arbitrary webhook URLs, leave web search off unless explicitly needed, and prefer environment or secure secret storage over persisting IMAGE_GEN_API_KEY to project or home .env files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to obtain and persist an API credential locally as part of normal operation. Storing bearer tokens in project-local files increases the chance of accidental disclosure through source control, backups, logs, or other local tooling, especially when the storage location is created automatically by the agent.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script recursively discovers package.json files and invokes `npm install` via `spawnSync`, which executes arbitrary lifecycle scripts from dependencies and can fetch untrusted code from the network. In an avatar-image-generator skill, this bootstrap capability is unrelated to core runtime behavior and materially increases supply-chain and code-execution risk if run in a privileged or automated environment.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill exposes a `--use-web-search` capability and propagates `use_web_search` to the upstream API, which is unrelated to the declared avatar/PFP generation purpose. This expands the skill from bounded image generation into a broader network-enabled operation, increasing data exposure and making prompt-driven external retrieval possible without a clear product need.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The CLI accepts an arbitrary `--webhook-url` and forwards it to the image-generation API, enabling callbacks to attacker-controlled destinations. In an agent setting, this creates an unnecessary outbound communication channel that can be abused for data exfiltration, request smuggling into internal services, or bypassing normal response handling.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: Although the manifest describes avatar/profile-picture generation, the code implements general-purpose text-to-image and image-to-image generation with broad style presets and batch modes. This scope mismatch weakens trust boundaries for agents and users, because a seemingly narrow skill can be repurposed for far more general content generation than advertised.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script defines and operationalizes multiple non-avatar workflows such as cover, rednote, infographic, comic, and article generation, which materially exceeds the declared skill scope of avatar/profile image generation. In an agent setting, this scope drift can cause the skill to be selected for unrelated image-generation tasks, bypassing policy gating, user expectations, or narrower review assumptions tied to the manifest.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The help text actively advertises the script as a general-purpose recommender for cover, infographic, comic, and article generation, reinforcing that the broader capability is intentional rather than incidental. This increases the likelihood that orchestrators or users will rely on the skill outside its declared avatar-only context, undermining trust boundaries and any policy assumptions based on the manifest.

Context-Inappropriate Capability

Medium

• Confidence: 86% confidence
• Finding: The setup script explicitly supports persisting IMAGE_GEN_API_KEY into project- or home-scoped .env files. While this is common developer tooling behavior, it expands the skill from image generation into local credential storage, increasing the chance of accidental secret exposure through checked-in project files, overly broad home-directory storage, or later access by other local processes.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The instructions direct the agent to collect and persist an API key into a local .env file and to handle setup on the user's behalf, which expands the skill from avatar generation into credential management. Even though the text says to treat the key as a secret, this still creates a sensitive-data handling path that can expose credentials through unintended file writes, workspace leakage, or over-broad agent behavior.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This section instructs the agent to initialize and manage a generic image-generation workspace, including model registry refresh, default model selection, config file creation, and later in-place updates. For an avatar-image-generator skill, this is capability expansion beyond the declared purpose and increases the chance of unauthorized file modification, unexpected behavior, and reuse as a general image-generation bootstrapper.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The script performs local project mutation beyond avatar generation by creating .image-skills/<namespace>/EXTEND.md and invoking bootstrap logic that can write additional files. In a skill whose stated purpose is image/avatar generation, this expands the trust boundary from content generation to host project modification, creating supply-chain and workspace integrity risk if run automatically or with an attacker-controlled project path.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code unconditionally calls bootstrapImpl when doctorImpl reports pending targets, meaning a readiness check can trigger file creation/modification in the local environment. That behavior is not justified by the advertised avatar-generation function, so if this script is exposed through agent tooling it could be abused to alter project state, introduce unexpected files, or prepare persistence in a developer workspace.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The CLI exposes a `--use-web-search` capability and propagates it into outbound API requests, even though the skill is described as an avatar/profile-picture generator. That expands the tool from bounded image generation into retrieval-augmented behavior that can leak user prompts to external search providers or fetch unneeded external context, increasing data exposure and attack surface without a clear product need.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code accepts an arbitrary `--webhook-url` and forwards it to the upstream generation service, allowing generated results and related metadata to be pushed to attacker-controlled endpoints. In an avatar generator, this is unnecessary for core functionality and creates a straightforward exfiltration channel outside the expected local-download flow.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: This wrapper accepts an arbitrary entry-script argument, resolves it from the current working directory, and executes it through `npx bun`, which goes beyond a narrowly scoped avatar-generation helper. In a skill context, this creates a generic code-execution pathway: if an attacker can influence `entryArg` or repository contents, they can run unintended scripts with the agent's environment variables and project context.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is broad enough to match many common requests for avatars, profile pictures, and headshots without clear activation boundaries or disambiguation criteria. In an agent environment, this can cause over-invocation or routing collisions with other image-generation or profile/photo-editing skills, leading the agent to apply the wrong workflow or expose unnecessary capabilities.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The implicit trigger phrase "Social profile pictures for me." is broad enough to match many ordinary image-editing or social-media-related requests, which can cause the skill to activate when the user did not specifically intend to invoke avatar generation. Over-broad activation increases the risk of incorrect tool routing, unintended prompt handling, and interference with more appropriate skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation tells the agent to persist `IMAGE_GEN_API_KEY` to a local `.env` path but does not require a clear user-facing warning that the secret will be stored on disk. That can lead users to unknowingly place sensitive credentials in a workspace where they may be exposed to other tools, collaborators, or version control.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup flow directs the agent to silently create directories and overwrite `EXTEND.md` with configuration defaults without explicit notice at the time of modification. Silent file writes in a user workspace can unexpectedly alter project state, clobber existing configuration, and normalize agent behavior that changes files without informed consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly states that local files may be base64-encoded and sent to a third-party API, and that Bearer-token authenticated requests are used, but it does not require an explicit user notice or consent flow before transfer. In an avatar-generation skill, users are likely to provide personal photos or facial images, so silent transmission to an external provider creates meaningful privacy and data-handling risk.

Credential Access

High

• Category: Privilege Escalation

Content

-h, --help            Show help

What this does:
  1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env
  2) Runs doctor (read-only)
  3) Ensures a MODELS.json exists (writes the bundled starter if missing)
  4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet

• Confidence: 84% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

if (isDirectRun) {
  try {
    const args = parseArgs(process.argv.slice(2));
    const apiKeyInput = resolveProvidedApiKey({ apiKey: args.apiKey, persistApiKey: args.persistApiKey, env: process.env });
    const apiKey = writeApiKeyConfig({
      project: args.project,
      homeDir: process.env.HOME ?? null,

• Confidence: 88% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/main.ts:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/run-generate.mjs:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/main.ts:47

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/main.ts:6

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:6