infinimo-ai-design-virtual-model

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward external image-generation integration, with expected uploads and API calls disclosed, though users should understand that photos, prompts, tokens, and generation logs are sent to the Infinimo/clawec service.

Install only if you are comfortable sending selected photos, optional background images, prompts, and your Infinimo API token to the declared external API. Avoid uploading sensitive images unless you understand the provider's retention and privacy terms, and do not use the documented log-delete endpoint unless you intentionally want to remove generation history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The workflow instructs uploading local source and background files to an external service, yet that data transfer is not prominently reflected in the declared purpose or permission model. In a skill processing user-provided photos, especially images of people, incomplete disclosure materially raises privacy and consent risks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The workflow instructs uploading local source and background files to an external service, yet that data transfer is not prominently reflected in the declared purpose or permission model. In a skill processing user-provided photos, especially images of people, incomplete disclosure materially raises privacy and consent risks.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents use of shell scripts and remote API operations but does not declare any tool scope or permissions. This weakens reviewability and enforcement, making it easier for a skill to perform networked file upload and other side effects without explicit authorization boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation tells the operator to upload source and background images and later delete logs, but it gives no warning that personal images are sent to a third-party service or that log deletion may remove records needed for audit or user recovery. For a photo-processing skill, silent transmission and destructive actions create meaningful privacy and integrity concerns.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest describes a skill for generating virtual model showcase images from photos and prompts. This schema additionally documents a `GET /aigc/log/delete` endpoint that deletes log records, which is not part of the stated generation workflow and represents extra destructive behavior beyond simply creating and retrieving generated images.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: A skill meant for fashion/model image generation would be expected to submit generation jobs and fetch outputs. Deleting log records is an administrative or cleanup capability that is not obviously required for generating showcase images and is not disclosed in the manifest description.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: A destructive endpoint is documented with no warning, confirmation guidance, or stated scope limitations, which increases the chance that an agent or integrator could invoke it unintentionally and delete audit or job history. In an agent context, exposing deletion operations adjacent to ordinary generation and polling endpoints makes accidental misuse more plausible, especially if the documentation does not distinguish safe read actions from irreversible actions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This code file makes an outbound HTTP request to a third-party API and includes user-provided data fields such as image URLs and prompts, along with a credential in the request header. The script contains no confirmation prompt, logging, or explanatory comment/docstring disclosing that these inputs and the token will be sent externally.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This script adds a capability to retrieve account or service logs from a third-party API, which is not aligned with the stated purpose of generating virtual model showcase images. Unnecessary access to operational logs expands the skill's data-access surface and could expose sensitive metadata, request history, or user activity without a clear functional need.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script reads an API credential from the environment and immediately transmits it to an external service, but the file provides no disclosure, user notice, or guardrails around that behavior. While authenticated API calls are normal, doing so in a hidden or undocumented utility script is risky because it can silently use privileged credentials to access data unrelated to the advertised skill behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script transmits a user-supplied local file and an authentication token to a remote third-party endpoint with no user-facing disclosure, confirmation, or logging of where the data is going. In a skill that handles source photos for virtual model generation, this increases privacy and data-handling risk because users may upload sensitive or proprietary images without realizing they are leaving the local environment.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The request includes a fixed natural-language parameter of "language=en", which forces a specific language/locale behavior. The file does not offer the user a language choice or document why English is required, which fits the language/locale policy-violation category.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The natural-language documentation specifies a common parameter of `language=en`, which can be read as forcing a specific language setting. Because the file does not offer opt-in language selection or explain that the skill is intentionally English-only, this conflicts with the locale-choice policy.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script accesses INFINIMO_TOKEN or INFINIMO_API_KEY and then uses the value for authentication, but there is no comment, help text, or user-visible notice explaining that a credential from the environment will be consumed. This is a safety-relevant operation because it involves handling authentication material.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The request parameter sets language=en unconditionally, which forces a specific language/locale in the skill behavior. There is no opt-in, user-selectable language parameter, or documented region-specific reason for this constraint.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The script includes a fixed language parameter of "en", which imposes a specific locale choice. No surrounding comment, option, or documentation indicates user opt-in or a justified reason for restricting the request to English.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The script accesses INFINIMO_TOKEN or INFINIMO_API_KEY for authentication, but there is no user-facing message or inline documentation indicating that sensitive environment credentials are required and will be used. This matches the code-file criterion for credential access lacking visible disclosure.

Static analysis

No suspicious patterns detected.