T09 · Insecure Skill Coding Practices
Error
- Location
scripts/main.ts:183- Finding
WeryAI API Key Can Be Forwarded to an Untrusted Result URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Children Book Image Generator
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a real WeryAI image-generation skill, but it has under-disclosed local-file and API-key handling that should be reviewed before installation.
Review this skill carefully before installing. Use it only in trusted projects, avoid untrusted batch files, local reference paths, and arbitrary webhook URLs, prefer an environment variable over persisted API keys, and consider preinstalling a trusted Bun version. The publisher should align the docs with actual reference-image behavior, restrict or remove local-file uploads, validate result-download origins before sending credentials, and harden secret-file permissions.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/main.ts:297- Finding
Arbitrary Readable Local Files Can Be Encoded and Uploaded as Reference Images
- Content
View full analysis
{ for (const refPath of paths) { const t = refPath.trim(); if (/^https?:\/\//i.test(t)) continue; const fullPath = path.resolve(refPath); try { await access(fullPath); } catch { throw new Error(`Reference image not found: ${fullPath}`); } } } ``` ### Technical Analysis Any readable local path supplied through `--ref`, `--reference`, or a batch task's `ref` field is resolved, read in full, Base64 encoded, and included in the request sent to WeryAI. The code does not verify that the path points to an actual image, inspect the file signature, enforce a size limit, confine access to the project directory, or require explicit confirmation for files outside an approved location. The MIME type is inferred only from the filename extension and defaults to `application/octet-stream`, so non-image files remain uploadable. This behavior also contradicts `SKILL.md:18`, which states that reference images must be public URLs and that local paths and `data:` URLs are rejected. ### Attack Path 1. An attacker or untrusted automation influences the command argume ...[truncated 1064 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.mjs:124- Finding
Persisted API Key Is Written Without Enforcing Owner-Only Permissions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/vendor/weryai-image/run-generate.mjs:22- Finding
Unpinned Bun Package Is Automatically Downloaded and Executed Through npx
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (85)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
A generic text-to-image client backed by a model registry is broader than the manifest suggests. Misrepresenting a general-purpose generation tool as a narrow children’s-book helper can lead to inappropriate approval, insufficient guardrails, and accidental transmission of prompts or content outside the intended domain.
- Content
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
ts } function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string { if (!style) return prompt; return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`; }
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
ts } function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string { if (!style) return prompt; return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`; }
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
ts const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The
--webhook-urloption allows arbitrary callback destinations to be supplied and forwarded to the external API. This creates an unexpected outbound data flow channel that can leak task metadata/results to attacker-controlled endpoints and is unnecessary for a children's illustration skill.- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The --scope home option allows the script to write API credentials into a file under the user's home directory, broadening the blast radius from one project to the entire user environment. A home-scoped secret file is more likely to be consumed by unrelated processes or survive long after the skill is removed, making unintended credential exposure and cross-project leakage more serious.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/bootstrap.mjs:86
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/doctor.mjs:56
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/smoke-check.mjs:18
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/shared-image-generation/scripts/doctor.mjs:56
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/discover-models.mjs:9
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/doctor.mjs:9
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/main.ts:14
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/recommend-model.mjs:9
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/run-generate.mjs:23
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/vendor/weryai-image/setup.mjs:9
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/main.ts:47
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/vendor/shared-image-generation/scripts/main.ts:51
File read combined with network send (possible exfiltration).
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/main.ts:6
File read combined with network send (possible exfiltration).
Warn
- Code
- suspicious.potential_exfiltration
- Location
- scripts/vendor/shared-image-generation/scripts/main.ts:6