T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.ts:193- Finding
WeryAI API Key Can Be Forwarded to an Arbitrary Result URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Avatar Image Generator
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it has under-disclosed local-file upload behavior and credential-handling risks that users should review before installing.
Install only if you are comfortable sending prompts, optional reference images, and generated-image metadata to WeryAI. Avoid using local reference-file paths until the documentation and implementation are aligned; use public HTTPS image URLs instead. Prefer setting `IMAGE_GEN_API_KEY` in your environment or a protected secret store rather than persisting it, and install Bun yourself from a trusted source instead of relying on the `npx -y bun` fallback.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.ts:298- Finding
Arbitrary Local Files Can Be Uploaded as Reference Images Contrary to the Declared Safety Boundary
- Content
View full analysis
= referenceImages.length > 0 ? { ...baseBody, images: referenceImages.map(toImagePayloadValue) } : baseBody; ``` The declared behavior states: ```md - **Reference images**: Must be public URLs (`https://` recommended). `http://` may work but is insecure. Local file paths and `data:` URLs are rejected. ``` ### Technical Analysis The implementation does not reject local paths. Instead, it resolves any non-HTTP value as a filesystem path, reads the complete file, Base64-encodes its contents, and submits the result to WeryAI. File validation only verifies that the path is accessible. It does not establish that the file is a legitimate image, enforce a permitted extension, inspect magic bytes, limit file size, restrict paths to an approved directory, or require explicit confirmation before upload. Unknown extensions are labeled as `application/octet-stream`, allowing non-image data to be transmitted. This behavior materially conflicts with the Skill's documented safety model. An agent or user relying on `SKILL.md` could reasonably assume that local files cannot ...[truncated 1248 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.mjs:126- Finding
Plaintext API Key Is Persisted Without Explicit Restrictive File Permissions
- Content
View full analysis
` additionally risks disclosure through shell history or process argument inspection, although the script itself does not echo the value. ### Attack Path 1. A user runs setup with `--persist-api-key` or `--api-key`. 2. The script writes `IMAGE_GEN_API_KEY` to `.image-skills/avatar-image-generator/.env`. 3. The resulting permissions are inherited from the ambient umask or existing file. 4. Another local user, process, workspace participant, or mounted-volume consumer reads the file. 5. The observer extracts and reuses the WeryAI API credential. ### Impact Assessment The issue may disclose the API key to other local principals with filesystem visibility. A stolen key may permit: - Unauthorized image-generation requests. - Consumption of paid balance or service ...[truncated 244 chars]- Remediation
View remediation
` because command-line arguments may enter shell history or process listings. Prefer environment input or protected standard input. 9. Apply equivalent protections to the vendored setup implementation. ]]>
T08 · Insecure Dependencies
Warning
- Location
scripts/vendor/weryai-image/run-generate.mjs:22- Finding
Unpinned Remote Bun Package Is Downloaded and Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (97)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
Generic text-to-image submission to an external API exceeds a narrowly described avatar/headshot function and could be repurposed for arbitrary image generation. In context, this makes the skill more dangerous because users and platform controls may trust it as a constrained creative tool while it actually exposes a broader remote generation interface.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
ts } function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string { if (!style) return prompt; return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`; }
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
ts } function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string { if (!style) return prompt; return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`; }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script allows writing credential material to a path under the user's home directory via --scope home, broadening persistence beyond the project boundary. Home-directory secret writes are more dangerous because they may affect multiple projects, survive project deletion, and create a larger target for accidental leakage or abuse by other local processes.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js -h, --help Show help What this does: 1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env 2) Runs doctor (read-only) 3) Ensures a MODELS.json exists (writes the bundled starter if missing) 4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts -h, --help Show help What this does: 1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env 2) Runs doctor (read-only) 3) Ensures a MODELS.json exists (writes the bundled starter if missing) 4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js -h, --help Show help What this does: 1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env 2) Runs doctor (read-only) 3) Ensures a MODELS.json exists (writes the bundled starter if missing) 4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js -h, --help Show help What this does: 1) Optionally writes IMAGE_GEN_API_KEY into the local skill .env 2) Runs doctor (read-only) 3) Ensures a MODELS.json exists (writes the bundled starter if missing) 4) Initializes EXTEND.md with Nano Banana 2 if no default model exists yet