Security audit

Comic

Security checks for vulnerabilities and agentic risk

Overview

The comic skill mostly matches its stated purpose, but it needs review because its runtime can expose the API key to unvalidated image URLs and can upload local files even though the main instructions say local paths are rejected.

Install only if you are comfortable sending comic prompts and approved reference assets to WeryAI, and avoid passing local reference paths unless you have inspected exactly what file will be uploaded. Prefer environment-only API keys or lock down any persisted .env file permissions, and treat setup/dependency installation as executing third-party package code.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vendor/shared-image-generation/scripts/main.ts:197
Finding: API bearer token may be disclosed to an arbitrary task-result URL
Content: View full analysis
``` Consequently, a URL controlled through a compromised or malicious gateway response can cause the WeryAI API key to be transmitted to an unrelated origin. This behavior exceeds the declared network scope of the Skill, which states that it communicates with `https://api.weryai.com`. The absence of an HTTPS requirement for task-result URLs also means that the bearer token could potentially be transmitted over an unencrypted HTTP connection if such a URL is returned. ### Attack Path 1. An attacker compromises or manipulates the gateway, a model backend, or the task-result response. 2. The task response includes an attacker-controlled image URL such as `https://attac ...[truncated 849 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vendor/shared-image-generation/scripts/main.ts:303
Finding: Arbitrary readable local files can be encoded and uploaded as reference images
Content: View full analysis
0 ? "/v1/generation/image-to-image" : "/v1/generation/text-to-image"; const body: Record = referenceImages.length > 0 ? { ...baseBody, images: referenceImages.map(toImagePayloadValue) } : baseBody; ``` ### Technical Analysis The primary Skill documentation states that reference images must be public URLs and that local paths and `data:` URLs are rejected. The implementation does the opposite for local paths: it resolves any supplied path, reads the complete file, Base64-encodes it as a data URL, and submits it to WeryAI. No project-root confinement, maximum file size, image magic-byte validation, symlink restriction, or user confirmation is applied. The MIME type is inferred only from the filename extension; unknown extensions are still transmitted as `application/octet-stream`. Using local character sheets is relevant to comic generation, but silently permitting arbitrary readable files is broader than the minimum privilege necessary and conflicts with the stated privacy boundary. ### Attack Path 1. An attacker influences a batch file, command invocation, or agent instruction used to build the `--ref` va ...[truncated 1175 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vendor/shared-image-generation/scripts/setup.mjs:114
Finding: Persisted API keys are written without restrictive filesystem permissions
Content: View full analysis
/.env` locations and uses the stored value as a bearer credential. ### Attack ...[truncated 1050 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:13
Finding: Unpinned packages are downloaded and executed during normal setup and command use
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (97)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: If the backend client handles task types beyond comics, including other media outputs, the skill may expose a broader remote-processing surface than users expect from a comic tool. That matters because broader media/task handling can expand data flows and make misuse or prompt-routing errors harder to reason about.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
- `scripts/scaffold.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
- `scripts/scaffold.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 348)May include surrounding context.
md
- `scripts/scaffold.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
- `scripts/build-batch.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
- `scripts/build-batch.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 350)May include surrounding context.
md
- `scripts/build-batch.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
- `scripts/merge-to-pdf.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
- `scripts/merge-to-pdf.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 282)May include surrounding context.
md
- `scripts/merge-to-pdf.ts`

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 352)May include surrounding context.
md
- `scripts/merge-to-pdf.ts`

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup.mjs:21

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/compression-runtime/scripts/main.ts:158

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/main.ts:15

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/run-generate.mjs:39

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

Code: suspicious.potential_exfiltration
Location: scripts/vendor/shared-image-generation/scripts/main.ts:6