T09 · Insecure Skill Coding Practices
Error
- Location
scripts/headshots.sh:6- Finding
Unvalidated API Base Allows API-Key and Biometric-Image Disclosure
- Content
View full analysis
- Remediation
View remediation
Security audit
MotuArt Color Engine
Security checks for vulnerabilities and agentic risk
Overview
This portrait-processing skill is mostly coherent, but it needs review because sensitive photos and API keys can be sent to an environment-selected server and some API-controlled filenames are not safely contained.
Review before installing. Use a least-privilege MCE_API_KEY, keep MCE_API_BASE unset or restricted to the official HTTPS service unless you intentionally use a separate trusted deployment with a separate key, and run outputs in a dedicated directory. Be especially cautious with passport, ID, and reusable headshot reference images until the scripts validate API origins and response-derived filenames.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/id-pack.sh:57- Finding
API-Controlled ID-Package Specifiers Permit Path Traversal and File Overwrite
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/headshots.sh:386- Finding
API-Controlled Headshot Resource IDs Permit Path Traversal and Arbitrary File Writes
- Content
View full analysis
/dev/null || true)" rm -f "$output" echo "Headshots download failed (HTTP $code): $error_body" >&2 exit 1 fi } ``` ### Technical Analysis The script uses API-provided `candidate_id`, `render_id`, and `export_id` values directly as path components. It performs no identifier valid ...[truncated 2136 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (37)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code is clearly related to the general declared domain of AI headshots and portrait processing through the Motu API, so there is substantial overlap. It does support source inspection, skin-base and smoothing previewing, garment preference, candidate generation, rendering, lighting, and exporting cropped outputs. However, the declared description materially overstates the implemented functionality: there is no mask/matte export, no explicit background swap operation, no compliance checker for ID/passport rules beyond a generic eligibility/source check, no upload optimization, and no print-sheet layout feature. The code also includes person-reference library management capabilities that are not mentioned in the description. Because the description presents a broader multifunction portrait/ID-photo toolkit than the code actually implements, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code’s actual behavior is much narrower than the declared description. It only performs portrait lighting adjustment through a specific HTTP endpoint, with parameters for style and strength. While this is loosely adjacent to portrait retouching, the description claims many additional capabilities—mask export, clothing replacement, AI headshots, ID-photo production, background swap, compliance checks, and print layouts—that are not present in this code chunk. This is a material description-to-behavior mismatch because the declared purpose suggests a multifunction portrait/ID-photo suite, whereas the code implements only portrait lighting.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad image-editing and headshot-generation skill with many portrait and ID-photo transformation capabilities. The actual code chunk does not perform any image processing, retouching, masking, clothing replacement, cropping, compliance checking, upload optimization, or print-sheet generation. Instead, it only retrieves and displays available styles from the API. While style discovery could be tangentially supportive to a larger image-generation workflow, this chunk’s primary behavior is materially different from the declared purpose and represents an undeclared capability/utility endpoint.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - Use `scripts/headshots.sh` when the user wants AI-generated professional, business, corporate, LinkedIn, or studio headshots. Keep reference preparation, conf
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md `{"person_reference_id":"hperson_...","scene_id":"professional_profile"}` starts a new project. - `POST /v1/headshots/projects/{project_id}/person-reference` with `{"person_reference_id":"hperson_..."}` switches the active person inside the same project. - `DELETE /v1/headshots/person-references/{person_reference_id}` soft-deletes only the library entry. Applying a person to an existing project replaces its future preparation source and appends a new immutable reference version. Historical jobs, candidates, favorites, and references remain intact.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh require_key person_id="${1:?remove-person requires a person reference id}" response="$(mktemp)" trap 'rm -f "$response"' EXIT api_json DELETE "/v1/headshots/person-references/$person_id" "$response" echo "removed person reference $person_id from the library; existing projects are unchanged" ;;
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh args=(-sS -A "motu-mce-skill/1.0" "$BASE/v1/styles") [ -n "${MCE_API_KEY:-}" ] && args+=(-H "X-API-Key: $MCE_API_KEY") curl "${args[@]}" | python3 -c ' import sys, json try: d = json.load(sys.stdin)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh args=(-sS -A "motu-mce-skill/1.0" "$BASE/v1/styles") [ -n "${MCE_API_KEY:-}" ] && args+=(-H "X-API-Key: $MCE_API_KEY") curl "${args[@]}" | python3 -c ' import sys, json try: d = json.load(sys.stdin)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh args=(-sS -A "motu-mce-skill/1.0" "$BASE/v1/styles") [ -n "${MCE_API_KEY:-}" ] && args+=(-H "X-API-Key: $MCE_API_KEY") curl "${args[@]}" | python3 -c ' import sys, json try: d = json.load(sys.stdin)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh args=(-sS -A "motu-mce-skill/1.0" "$BASE/v1/styles") [ -n "${MCE_API_KEY:-}" ] && args+=(-H "X-API-Key: $MCE_API_KEY") curl "${args[@]}" | python3 -c ' import sys, json try: d = json.load(sys.stdin)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh args=(-sS -A "motu-mce-skill/1.0" "$BASE/v1/styles") [ -n "${MCE_API_KEY:-}" ] && args+=(-H "X-API-Key: $MCE_API_KEY") curl "${args[@]}" | python3 -c ' import sys, json try: d = json.load(sys.stdin)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs use of shell scripts plus file read/write behavior but does not declare any tool scope or allowed-tools restrictions. In an agent environment, that expands the attack surface because ordinary user requests could trigger filesystem and shell operations without an explicit least-privilege boundary.
- Content
Static analysis
No suspicious patterns detected.