Security audit

Agent Selfie

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate avatar generator, but it needs review because it can guide agents toward public profile changes and has unsafe handling of remote image URLs.

Install only if you are comfortable sending personality/style prompts to SkillBoss and storing generated prompts locally. Do not allow automatic Discord/Twitter/AgentGram avatar changes unless you explicitly approve each change, and avoid running this from sensitive networks until the image URL validation issue is fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/selfie.py:143
Finding: Unrestricted Dereferencing of a Server-Controlled Image URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/selfie.py:150
Finding: Stored HTML Injection Through Unescaped Personality Data
Content: View full analysis
None: thumbs = "\n".join( [ f'\n' f' \n' f' {it["prompt"]}\n' f'' for it in items ] ) ``` The generated content is subsequently written to the gallery: ```python (out_dir / "index.html").write_text(html, encoding="utf-8") ``` ### Technical Analysis The `prompt` value includes the personality's `name`, `style`, and `vibe`. These values may originate from inline JSON or a user-selected JSON file and are not restricted to plain text strings or escaped before insertion into HTML. The prompt is interpolated directly inside a `` element. An attacker can therefore close the existing element and insert arbitrary HTML, including script-capable elements, event handlers, external resources, deceptive forms, or navigation markup. Because the injected value is saved in `index.html`, the vulnerability is persistent: the payload remains in the generated gallery and activates when the user opens it. The generated filenames are internally derived and sanitized, but that does not protect the independently unescaped prompt field. ### Attack Path 1. An attacker supplies or convinces the victim to use a personality JSON file containing HTML in `name`, `style`, or `vibe`. 2. `load_personality()` accepts the JSON object and preserves the malicious field value. 3. `build_prompt()` incorporates that value into the generated prompt. 4. `write_gallery()` inserts the prompt into `` without HTML escaping. 5. The script writes the resulting payload to `index.html`. 6. When the victim opens the gallery, the ...[truncated 865 chars]
Remediation: View remediation
` instead of the original prompt. ]]>

T08 · Insecure Dependencies

Warning

Location: INSTALL.md:4
Finding: Unpinned Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
install agent-selfie ``` 2. Prefer installing dependencies through a committed lockfile with integrity hashes. 3. Document the expected package source, publisher identity, version, and verification procedure. 4. Where available, verify package signatures, provenance attestations, or checksums before execution. 5. Avoid recommending automatic updates that execute the latest release without review. 6. Provide a manual installation option using a pinned Git commit or signed release archive. 7. In CI and managed environments, use an approved internal registry or cached artifact rather than resolving executable packages dynamically. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The heartbeat instructs the agent to update Discord/Twitter/AgentGram avatars, which expands behavior from image generation into modifying external accounts. That creates an unsolicited side effect on third-party services and can change public-facing identity without explicit per-action user approval or clearly declared capability boundaries.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented purpose of the skill is self-portrait generation, but the heartbeat adds profile-modification actions on external platforms. This scope expansion is risky because operators may enable the skill expecting only local content generation, while it can instead perform outward-facing account changes with reputational or operational consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions describe updating avatars on external services without warning the user that third-party accounts may be modified. Lack of disclosure and confirmation increases the chance of surprise account changes, accidental misuse of connected credentials, and user trust or branding damage.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The installation guide instructs users to run npx clawhub install agent-selfie without pinning a specific version of the package being executed. This can cause users to fetch and run whatever the latest published clawhub package is at install time, increasing supply-chain risk if the package is updated maliciously or unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The update command npx clawhub update agent-selfie again relies on an unpinned npx package execution path, which may retrieve and run a different package version than originally reviewed. In a skill ecosystem, update paths are especially sensitive because users may trust them and execute them repeatedly over time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx clawhub install agent-selfie without pinning an exact package version. This can cause execution of whatever version is currently published or resolved at install time, increasing supply-chain risk if the package is compromised, typosquatted, or updated maliciously.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises use of environment variables, local file output, and an external API, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can cause users or hosting platforms to grant broader capabilities than they intended, especially for a skill that reads an API key, writes files, and performs network requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation does not clearly warn users that personality data, style descriptions, and related prompt content are transmitted to the external SkillBoss API service. Because this skill is specifically designed around identity/avatar generation, users may include sensitive branding, persona, or personal descriptors they would not expect to leave the local environment, creating a privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The quickstart instruction uses npx clawhub install agent-selfie without pinning an explicit version of the package or runner, which allows users to fetch whatever version is current at install time. If the upstream package, dependency chain, or publishing account is compromised, users could execute unexpected code during installation or use, making this a real supply-chain risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/selfie.py (reported line 14)May include surrounding context.
python
import urllib.request from pathlib import Path API_BASE = "https://api.heybossai.com/v1" DEFAULT_PERSONALITY = { "name": "Agent",

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script sends prompts built from user-supplied personality, mood, and theme data to a third-party remote API, but it does not provide an explicit notice or consent step explaining that this content will leave the local environment. In an agent setting, personality fields may contain sensitive identifiers or internal context, so silent transmission can create an unexpected privacy and data-handling risk even if the feature is intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script stores generated images, the full prompt, and an HTML gallery on local disk without clearly warning the user that their content will be persisted. If prompts or personality data contain sensitive or identifying information, this can leave recoverable artifacts on shared machines or in synced directories.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.