Security audit

Cubistic Painter

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it exposes the bot API key in logs and does not enforce that the key is sent only to a trusted HTTPS backend.

Review before installing or running. Only run this with a low-privilege Cubistic bot key, set BACKEND_URL manually to the intended HTTPS backend, avoid running loop mode where logs are retained, and rotate the key if it has already appeared in terminal, CI, or service logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run-loop.mjs:174
Finding: API Key Disclosed Through Process Logs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run-once.mjs:145
Finding: API Key Can Be Sent to an Untrusted or Plaintext Backend in Run-Once Mode
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run-loop.mjs:141
Finding: API Key Can Be Repeatedly Sent to an Untrusted or Plaintext Backend in Loop Mode
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.
md
- `scripts/run-once.mjs` — attempt one paint (gentle mode: only paints Void pixels)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
- `scripts/run-once.mjs` — attempt one paint (gentle mode: only paints Void pixels)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.
md
- `scripts/run-loop.mjs` — repeat politely with backoff

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.
md
- `scripts/run-loop.mjs` — repeat politely with backoff

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs users to run Node scripts that use both environment variables and outbound network access, but it does not declare any tool scope or permissions metadata. This creates a transparency and policy-enforcement gap: an agent or reviewer cannot easily constrain or audit the skill’s ability to read secrets like API_KEY and send data to an external backend, which is especially relevant because the skill targets a public external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script logs the full API_KEY at startup via the bot field, which can expose a live credential in terminal history, CI logs, process supervisors, or centralized log aggregation systems. Because this key is used as the X-Api-Key for authenticated actions, anyone who can read those logs may be able to impersonate the bot and perform unauthorized API operations.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/run-loop.mjs:9

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/run-once.mjs:18