Security audit

adsturbo-image

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its image-generation purpose, but it includes a public upload helper broad enough to send arbitrary local files to AdsTurbo without clear user confirmation or privacy warnings.

Review before installing if you may work with private product images, customer media, internal creative assets, documents, audio, or regulated data. Use only files you are authorized to send to AdsTurbo, assume uploaded assets may be accessible by URL, and avoid using the generic file/audio upload commands unless they are explicitly needed and understood.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill clearly relies on environment variables and external network access, but it does not declare those permissions. Undeclared capabilities reduce transparency and prevent informed consent or policy enforcement by the host, especially because prompts and image URLs are sent to a third-party service. In a skill that handles user-supplied media and remote resources, hidden env/network use is a meaningful security and privacy concern.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The stated purpose is image generation/editing, but the skill behavior also includes generic file upload, audio upload, and independent async task querying. That mismatch can surprise users and reviewers, and it broadens the effective data-handling scope beyond what the description suggests. In practice, this can lead to unintended exfiltration of user files or misuse of the skill as a general upload bridge to a public URL.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill instructs users to provide prompts and public image URLs to an external service but does not warn that this content will be transmitted off-platform. That creates a privacy and data-governance risk, especially for sensitive images, copyrighted material, or internal marketing assets. In the context of image editing and e-commerce content, users may easily submit proprietary or personal media without realizing it leaves the local environment.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation explicitly requires users to upload images to a public URL, which can expose private, proprietary, or regulated image content to anyone with the link and to unintended third parties. In this skill context, users are likely to process product photos, marketing assets, or user-supplied images, so failing to warn about public accessibility materially increases the risk of data leakage and compliance issues.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: These commands take an arbitrary local path and upload the referenced file to remote storage, while the module docstring explicitly states it returns a public URL. There is no user-facing warning, confirmation, or sensitivity check before transmission, creating a real risk of accidental exfiltration of local or confidential files, especially because the tool supports generic files and audio in addition to images.

Unpinned Dependencies

Low

Category: Supply Chain
Content: requests>=2.28.0
Confidence: 95% confidence
Finding: The dependency is specified with a lower bound only (requests>=2.28.0), which makes builds non-reproducible and allows installation of unexpected versions over time. While not inherently exploitable by itself, unpinned dependencies increase supply-chain risk and can accidentally introduce vulnerable or breaking versions into the skill.

Static analysis

No suspicious patterns detected.