Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed image-generation integration, but its setup asks users to run a mutable latest npm MCP package with an API key, which needs careful review.
Install only if you trust Evolink and are comfortable sending prompts and images to its services. For safer setup, pin and review the MCP npm package version instead of running @latest, protect EVOLINK_API_KEY, and do not upload private, regulated, or confidential images unless public-link hosting for up to 72 hours is acceptable.
**mcporter** (recommended): `mcporter call --stdio "npx -y @evolinkai/evolink-media@latest" list_models`
**Claude Code:** `claude mcp add evolink-media -e EVOLINK_API_KEY=your-key -- npx -y @evolinkai/evolink-media@latest`
**Claude Desktop / Cursor** — add MCP server with command `npx -y @evolinkai/evolink-media@latest` and env `EVOLINK_API_KEY=your-key`. See `references/image-api-params.md` for full config JSON.
Technical Analysis
The documented setup commands use npx -y to download and execute the mutable @latest release of @evolinkai/evolink-media. No exact version or package integrity value is specified. Consequently, the code executed by users can change after this Skill has been audited.
The -y option suppresses the installation confirmation. If the package publisher account, npm distribution channel, or a future package release is compromised, following the documented setup instructions could immediately execute attacker-controlled JavaScript on the local system.
This is a supply-chain risk rather than evidence that the package's current release is malicious.
Attack Path
An attacker compromises the npm publisher account, release process, or another component of the package's distribution chain.
The attacker publishes a malicious release under the package name and causes it to resolve through the latest tag.
A user follows one of the setup commands in SKILL.md.
npx -y downloads the newly published release and executes its package entry point or lifecycle behavior without interactive confirmation.
The malicious process runs with the invoking user's privileges and may inherit configuration or environment variables supplied to the MCP server, including EVOLINK_API_KEY.
Impact A
...[truncated 525 chars]
Remediation
View remediation
Remediation Suggestions
Replace @latest with an exact, reviewed version, for example:
bash
npx -y @evolinkai/evolink-media@1.2.3
The actual version should be selected only after review.
Verify the package lockfile, registry provenance, and integrity hash before deployment.
Establish a controlled update process in which each new package version is reviewed and tested before changing the pinned version.
Avoid automatic confirmation where practical so unexpected package acquisition remains visible to users.
Run the MCP server with least privilege. Restrict its filesystem access, outbound network destinations, and environment variables to those strictly required.
Supply EVOLINK_API_KEY through a protected secret-management mechanism and rotate it promptly if package compromise is suspected.
For higher-assurance deployments, install the reviewed dependency into a locked environment or container rather than downloading executable code at invocation time.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
| Service | URL |
|---------|-----|
| Generation API | `https://api.evolink.ai/v1/images/generations` (POST) |
| Task Status | `https://api.evolink.ai/v1/tasks/{task_id}` (GET) |
| File API | `https://files-api.evolink.ai/api/v1/files/*` (upload/list/delete) |
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.
md
| Service | URL |
|---------|-----|
| Generation API | `https://api.evolink.ai/v1/images/generations` (POST) |
| Task Status | `https://api.evolink.ai/v1/tasks/{task_id}` (GET) |
| File API | `https://files-api.evolink.ai/api/v1/files/*` (upload/list/delete) |
Rp1
Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding
The skill instructs users to launch an MCP server via npx -y @evolinkai/evolink-media without pinning an immutable version. This creates a supply-chain risk: a future malicious or compromised package release could execute arbitrary code in the user's environment and gain access to EVOLINK_API_KEY or other local resources.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding
The Claude Code setup command uses npx -y @evolinkai/evolink-media@latest, which will always fetch the newest published package version at runtime. If the npm package or publisher account is compromised, users could unknowingly run attacker-controlled code with access to the provided API key and local machine context.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding
The Desktop/Cursor instructions again direct users to run the MCP server from an unpinned npm package. Repeatedly encouraging dynamic package execution increases the chance of supply-chain compromise across environments, especially because the server is configured with a live API credential.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The documentation explicitly tells users to use a file hosting service to obtain publicly accessible URLs, but it does not warn that uploaded images become accessible via public links. In a skill focused on image generation and editing, users may upload sensitive or private images without realizing they are exposing them to third-party hosting and link-based access for up to 72 hours.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding
This file instructs users to transmit local files or remote file URLs, along with an authorization token, to an external third-party service. External transmission is expected for the feature, but it still creates real confidentiality and privacy risk because user-supplied images may leave the local environment and become hosted on Evolink infrastructure.
Content
Scanner excerpt · references/file-api.md (reported line 11)May include surrounding context.
The documentation explicitly supports uploading local files, base64 content, and fetching remote URLs, but it does not warn users that these actions transfer data to external Evolink infrastructure and may expose sensitive local or third-party content. In an agent skill context, this omission can lead to unsafe handling of private files or SSRF-like retrieval of internal URLs if the skill later accepts untrusted inputs for file_path or file_url.
Content
No source excerpt is available for this finding.
Indirect Prompt Extraction
Medium
Category
System Prompt Leakage
Confidence
75% confidence
Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
Content
Scanner excerpt · references/image-api-params.md (reported line 164)May include surrounding context.
md
| Code | Retryable | Resolution |
|------|-----------|------------|
| `content_policy_violation` | No | Rephrase prompt; avoid NSFW, violence, real person names |
| `invalid_parameters` | No | Check param values against model limits |
| `image_dimension_mismatch` | No | Resize image to match requested aspect ratio |
| `image_processing_error` | No | Check format (JPG/PNG/WebP), size (<10MB), URL accessibility |
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
83% confidence
Finding
The delete endpoint is documented as a simple command with no warning that it permanently removes hosted files. This can lead to accidental data loss or broken downstream references if users invoke deletion without understanding the destructive effect.
