ChatArt

• Outcome: Review
• Latest audit: Jun 26, 2026 · 7:07 PM UTC
• Version: 1.0.3

Overview

This ChatArt media-generation skill is mostly coherent, but it needs review because it handles account credentials, device identity, uploads, and remote media fetching with some under-disclosed and risky behaviors.

Review before installing. Use only with media you are comfortable sending to ChatArt or its storage backend, avoid internal/private URLs, and assume login/account details may appear in agent logs until the debug prints are removed. Prefer a patched version that redacts auth responses, documents uploads clearly, separates local logout from remote device unbind, and pins safe dependency versions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (46)

Tainted flow: 'CLIENT_ID' from os.environ.get (line 92, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

"""Full login flow: init device code → open browser → poll until done."""
    try:
        _delete_credentials()
        resp = requests.post(
            # f"{OAUTH_BASE_URL}/oauth/api/device/init",
            f"{BASE_URL}/web/xskill/init",
            json={

• Confidence: 90% confidence
• Finding: resp = requests.post( # f"{OAUTH_BASE_URL}/oauth/api/device/init", f"{BASE_URL}/web/xskill/init", json={ "identity_id": CLIENT_ID

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill exposes substantial capabilities—shell execution, file read/write, environment access, and network access—without declaring permissions or warning users. That combination enables silent credential handling, local file access, and external data transfer, which is especially risky for a skill that processes user media and performs authentication.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The advertised purpose focuses on media generation, but the actual behavior also includes login flows, local credential storage, account switching, credit queries, and usage-history access. This mismatch undermines informed consent because users may invoke the skill for creative work without realizing it can access account state and historical activity.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill can automatically download remote image URLs to local files via --output-dir, which expands its capability beyond simple generation/editing into local file writes and network retrieval. In an agent setting, this can cause unexpected disk writes, persistence of untrusted content, and silent data handling not clearly disclosed by the skill description.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The image edit flow accepts local file paths and uploads them to a remote service, but this data-transfer behavior is not clearly reflected in the manifest description. In an agent environment, that creates a risk of unintentionally exfiltrating sensitive local files if a user or upstream component passes a path without understanding it will be uploaded.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The helper derives a stable device fingerprint from username and hardware/system characteristics and uses it as a client identifier, even though the skill's stated purpose is media generation. This creates unnecessary collection and transmission of local identity data, increasing tracking risk and exposing host metadata without clear user consent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The logout/account-switch path does more than delete local credentials: it performs a remote unbind/account-management action. That exceeds user expectations for a local logout operation and can alter server-side account/device state, which is sensitive behavior for an auth helper.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The top-level documentation states that logout removes saved credentials, but the implementation also attempts a remote device unbind before deleting the file. This mismatch can mislead users into invoking a server-side account action they did not intend, undermining informed consent and trust.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The client builds the request URL as `BASE_URL + path` only when `path` starts with `/`; otherwise it uses the supplied `path` verbatim. Because authenticated headers are always attached, any caller that can influence `path` can cause bearer credentials and identity headers to be sent to an arbitrary external host, creating a credential exfiltration/SSRF-style primitive.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The module description says it uploads local files, but resolve_local_file also accepts arbitrary http/https URLs, downloads them, and re-uploads the content to ChatArt OSS. In an agent skill context, that creates an SSRF-like data-ingestion path and can exfiltrate fetched content to remote storage without clear user intent, making the behavior materially more dangerous than documented.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file's behavior does not match the skill manifest: instead of performing image/video generation or editing, it queries account credit balance and generation history. This kind of scope mismatch is dangerous because it expands access to user account metadata and usage information beyond what a user would reasonably expect from the advertised skill, increasing the risk of covert data collection or privacy violations.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The script downloads remote/generated videos to the local filesystem, creating persistent local side effects that are not clearly disclosed by the manifest. In an agent setting, undisclosed file writes can surprise users, consume disk space, and store sensitive media locally where other local processes or users may access it.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation description is broad enough to match many ordinary creative requests, increasing the chance the skill is auto-selected in contexts where users do not expect external uploads, authentication, or account-linked actions. Over-broad routing magnifies the risk of unintended execution of powerful capabilities.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The document states that local image/audio/video files are auto-uploaded when passed as arguments, but the skill description does not clearly warn users that local files will be sent to an external service. This creates a material privacy and data-exfiltration risk, especially if users supply sensitive personal or proprietary media.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to provide prompts and reference images to AI-powered models but does not disclose that these inputs may be transmitted to an external service. In this skill context, users may supply sensitive images or proprietary text, so the lack of an explicit data-sharing warning creates a real privacy and confidentiality risk.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The examples show downloading generated results into a local output directory without warning that the command writes files to disk. While expected for an image-generation tool, undisclosed local writes can surprise users, especially in automated or restricted environments, and may lead to accidental storage of untrusted or sensitive content.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The `status` command displays personally identifiable information (name, email, uid) and a partially masked API key. In an agent context, this can be surfaced into logs, chat transcripts, screenshots, or telemetry without explicit user consent or warning, creating unnecessary exposure of sensitive account metadata.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: `accountswitch` performs destructive actions—remote device unbind and local credential deletion—yet the skill frames it as a normal convenience flow without a strong warning or confirmation requirement. In an autonomous agent setting, this increases the risk of accidental account disruption or loss of an active authenticated session.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation repeatedly instructs users to provide local file paths or remote URLs for frames, images, and videos, but does not warn that these assets may be uploaded to or fetched by an external video-generation service. This creates a real privacy and data-handling risk because users may unknowingly transmit sensitive local media, proprietary content, or internal URLs to a third party.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation explicitly allows `--input-image` and `--input-video` to be local files or remote URLs but does not warn users that those assets may be transmitted to an external AI/video processing service. This creates a real privacy and data-handling risk because users may provide sensitive media or internal URLs without informed consent about upload, retention, or third-party access.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs use of cloud APIs, browser-based OAuth, local credential storage, and media upload workflows, but does not disclose privacy or data-handling implications to the user. In an agent skill context, this can cause users to unknowingly transmit sensitive images, videos, or metadata to third-party services and persist credentials on disk without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code supports both uploading local images and downloading generated images without an explicit warning or confirmation about remote transfer and local persistence. That can lead to privacy and data-handling surprises, especially when the agent is used on systems containing sensitive files or when returned URLs point to untrusted content.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The generated client identifier is based on local username and system attributes, then transmitted to a remote service without a clear warning. Even though hashed, it is still a stable derived identifier that can enable device tracking and correlation across sessions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code prints the full token/authorization response to stdout during polling, which may include access tokens, API keys, identity IDs, email addresses, or other credential-related data. Those secrets can leak into terminal logs, CI output, shell history capture, or support transcripts, enabling account compromise.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The helper fetches arbitrary remote URLs and writes the full response body to a local temporary file before parsing it, without any URL allowlisting, size limits, timeout, or network-scope restrictions. In a skill that processes user-supplied media, this can enable SSRF to internal services and resource-exhaustion through large or slow responses, with the local temp-file write increasing exposure on the host.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.