Security audit

aigc-images

Security checks across malware telemetry and agentic risk

Overview

This BizyAir image-generation skill mostly matches its stated purpose, but it needs review because it stores API keys in a shared temp file and automatically changes people-related prompts in a sexualized, specific way.

Install only if you are comfortable sending prompts and generation parameters to BizyAir. Use your own trusted API keys, avoid URL-downloaded key lists unless you fully trust the source, and require the agent to show the final prompt, number of tasks, and exact key-handling plan before running. Do not use this on shared machines unless the /tmp API-key storage is removed or replaced with safer secret handling.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill embeds extensive shell commands and network/file-system operations but does not declare corresponding permissions. This weakens platform trust boundaries and can cause the skill to execute capabilities users or the host may not expect, especially around local file reads and network transmission of secrets.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented behavior does not accurately match what the skill operationalizes, and it introduces extra prompt manipulation for human/model imagery that is not part of the core stated purpose. Security-relevant mismatches reduce informed consent and make it easier to hide unsafe handling of secrets or unexpected content generation behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script contains a hard-coded sexualized prompt suffix and silently appends it when model-related keywords are detected. This alters user intent without informed consent, can generate inappropriate or policy-violating content, and introduces hidden behavior unrelated to a generic image-generation skill.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The header presents the script as a generic storyboard/image generator, but the code later rewrites prompts behind the user's back. Hidden prompt mutation undermines user trust, can cause unsafe or unexpected outputs, and is especially concerning in an agent skill that may be invoked automatically based on task descriptions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill allows API keys to be fetched from an arbitrary remote URL without prominently warning the user that credentials are being downloaded over the network from a third-party location. This increases the risk of secret interception, malicious key injection, or accidental use of attacker-controlled credential material.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The task-state design stores API keys in plaintext in /tmp without disclosing that highly sensitive credentials are written to a world-accessible temporary location on many systems. This creates a practical secret exposure risk via other local users, processes, crash artifacts, backups, or forensic collection.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly instructs storing API keys alongside request IDs in a plaintext task-state file and reusing them later for polling and output retrieval. This normalizes unsafe secret handling and creates a straightforward credential disclosure path through local file access, logs, debugging, or natural-language resurfacing of stored values.

Ssd 3

Medium

Confidence: 87% confidence
Finding: The result-display and historical-query flow encourages retaining and presenting request metadata tied to previously stored credentials, which increases the chance of correlating sensitive task activity with exposed secrets. Even if keys are not directly displayed here, the workflow legitimizes prolonged storage and reuse of sensitive operational metadata.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.