Security audit

SnapOG

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward SnapOG API helper, but users should treat image parameters, asset URLs, signed URLs, and the API key as sensitive.

Install only if you are comfortable sending the image text, template parameters, and referenced asset URLs to SnapOG. Do not use secrets, private URLs, confidential campaign data, or regulated personal data in parameters. Keep SNAPOG_API_KEY out of code, logs, screenshots, and shared command history, and treat signed image URLs as bearer-style links that may be visible wherever they are embedded.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (12)

External Transmission

Medium

Category: Data Exfiltration
Content: ### 1. List templates and discover parameters ```bash curl https://api.snapog.dev/v1/templates ``` Returns all templates with their `paramSchema` (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 1. List templates and discover parameters ```bash curl https://api.snapog.dev/v1/templates ``` Returns all templates with their `paramSchema` (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 1. List templates and discover parameters ```bash curl https://api.snapog.dev/v1/templates ``` Returns all templates with their `paramSchema` (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 1. List templates and discover parameters ```bash curl https://api.snapog.dev/v1/templates ``` Returns all templates with their `paramSchema` (parameter names, types, required fields, defaults). Always call this first if the user hasn't specified a template.
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs users to send titles, tags, author names, and publicly accessible asset URLs to a third-party API, but it does not warn that this user-provided content leaves the local environment and is transmitted to SnapOG. This creates a privacy and data-handling risk because users may unknowingly submit sensitive text, internal branding assets, or confidential URLs to an external service.

External Transmission

Medium

Category: Data Exfiltration
Content: Use this for downloading images or advanced options: ```bash curl -X POST https://api.snapog.dev/v1/generate \ -H "Authorization: Bearer $SNAPOG_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 90% confidence
Finding: The generate endpoint sends user-supplied content and potentially external asset URLs to a third-party API using an authenticated request. In this skill context, that behavior is core functionality, but it still poses a real data exposure risk if users provide sensitive text, internal metadata, or private resource URLs without warning.

External Transmission

Medium

Category: Data Exfiltration
Content: Use this when the user needs a URL to embed in HTML meta tags, markdown, or anywhere an image URL is needed: ``` https://api.snapog.dev/v1/og/blog-post?title=Building+with+MCP&author=Taylor&tags=AI,Tools ``` This URL itself serves the image. Parameters are query strings. Requires `Authorization` header or a signed URL.
Confidence: 89% confidence
Finding: The URL-based generation flow places content parameters directly into the query string, which can be exposed through browser history, logs, referrer headers, analytics systems, and shared HTML or markdown. In addition to external transmission, this makes accidental disclosure more likely than a POST body workflow.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 4. Preview a template (no auth needed) ```bash curl https://api.snapog.dev/v1/preview/blog-post --output preview.png ``` Renders the template with its default parameters. Useful for showing the user what a template looks like before customizing.
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

Category: Data Exfiltration
Content: Signed URLs let you embed images in `<meta>` tags without exposing the API key: ```bash curl -X POST https://api.snapog.dev/v1/sign \ -H "Authorization: Bearer $SNAPOG_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 92% confidence
Finding: Creating signed URLs delegates access to generated images via bearer-style tokens embedded in the URL. If those links are shared, logged, cached, or leaked through referrers, unauthorized parties may access the generated content until expiry.

External Transmission

Medium

Category: Data Exfiltration
Content: }' ``` Returns `{ "url": "https://api.snapog.dev/v1/og/blog-post?title=...&token=..." }`. This URL works without authentication and can be placed directly in HTML: ```html <meta property="og:image" content="SIGNED_URL_HERE" />
Confidence: 91% confidence
Finding: The returned signed URL contains access parameters in the URL itself and is intended for direct embedding in HTML metadata. Such URLs are prone to leakage through page source inspection, CMS logs, analytics pipelines, and downstream caching layers, which can expose access to the image resource until the token expires.

External Transmission

Medium

Category: Data Exfiltration
Content: Generate the same image in multiple sizes at once: ```bash curl -X POST https://api.snapog.dev/v1/batch \ -H "Authorization: Bearer $SNAPOG_API_KEY" \ -H "Content-Type: application/json" \ -d '{
Confidence: 88% confidence
Finding: The batch endpoint increases the volume of user content and asset references sent to the third-party service in a single operation. While expected for the feature, it amplifies privacy exposure and operational impact if users submit sensitive data or private asset URLs.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The skill states that the API key is read from the SNAPOG_API_KEY environment variable, but it does not include guidance on safe credential handling. While the examples do not explicitly leak the secret, the omission may encourage unsafe operational practices such as exposing the key in logs, screenshots, shared shell history, or embedded URLs.

Static analysis

No suspicious patterns detected.