T08 · Insecure Dependencies
Error
- Location
SKILL.md:47- Finding
Unpinned Third-Party CLI Installation and Immediate Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Pixcli Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill’s creative media workflow is mostly coherent, but it asks for broad command/file authority and encourages unpinned npm/npx execution that users should review before installing.
Install only if you are comfortable running pixcli/Remotion in a sandboxed project with limited environment variables. Pin package versions where possible, avoid unreviewed npx commands, and do not submit confidential, regulated, or private media unless third-party processing is approved.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:10- Finding
Overly Broad Shell and File-System Tool Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (74)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a full-featured creative toolkit with generation capabilities across multiple media types plus Remotion-based assembly. The supplied code chunk is only a minimal Remotion bootstrap file that imports a root component and calls
registerRoot. It supports only a small part of the declared Remotion templating/assembly story and does not implement the primary claimed capabilities. Because the actual code is materially narrower than the declared purpose, this is a description-behavior mismatch.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a comprehensive media-generation and assembly skill, but the supplied code chunk is a narrow configuration file for Remotion. It does not perform image/video/audio generation, invoke pixcli, assemble content beyond basic output settings, or expose the broader capabilities claimed. This is a materially different and much narrower behavior than the declared purpose, so it should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description describes a full-featured multimedia generation and assembly skill. The supplied code chunk, however, is only a minimal Remotion entry file that registers a Root component. It does not implement or expose the declared generation capabilities, pixcli integration, prompt handling, model selection, or broader assembly workflow. Based on this code chunk alone, the actual behavior is far narrower than the declared purpose, so this is a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description claims a comprehensive end-to-end multimedia generation and assembly toolkit. The supplied code chunk does not implement or demonstrate any of those generation capabilities; it merely adjusts two Remotion configuration settings for output behavior. While this code is loosely related to the Remotion assembly portion, it materially underrepresents the declared primary purpose and scope. Therefore the description does not accurately represent what this specific code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code chunk is a minimal Remotion template bootstrap file. Its sole function is to import a root component and register it with Remotion. That is consistent with one small part of video assembly, but it does not substantiate the declared description's primary purpose as a full creative generation toolkit using pixcli for images, video, voice, music, and sound effects. The description is materially broader than the actual behavior shown in this code chunk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The README instructs users to run
npx remotionwithout pinning a specific package version.npxwill resolve and execute whatever version is current or otherwise selected from the registry, which creates a supply-chain risk if a malicious or breaking version is published or if dependency resolution changes over time. In this skill context, the command is presented as part of the normal workflow, so users are likely to execute it directly.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The command
npx remotion renderis documented without a pinned version, again allowing execution of an unpinned package from the registry. This exposes users to supply-chain compromise or unexpected behavior if the package or its dependencies change, and the risk is heightened because rendering is part of the recommended production workflow.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README describes API-key based use and multiple external model providers, but it does not clearly warn that prompts, images, videos, audio, and related metadata may be transmitted to third-party services for processing. Users may unknowingly send sensitive or proprietary content to external providers, creating confidentiality, privacy, and compliance risks. The skill context increases the concern because the tool is explicitly designed to process rich media and creative assets, which often contain confidential branding or user data.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The manifest itself references
npx remotionwithout version pinning, making the unsafe behavior part of the skill's declared allowed execution surface. Because allowed-tools govern what an agent may run, this materially increases risk beyond a mere documentation issue.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The manifest itself references
npx remotionwithout version pinning, making the unsafe behavior part of the skill's declared allowed execution surface. Because allowed-tools govern what an agent may run, this materially increases risk beyond a mere documentation issue.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The manifest allows execution of
npx pixcli *andnpx remotion *without version pinning, which can fetch and run whatever package version is current at invocation time. That creates a supply-chain risk: a compromised upstream release, typosquat, or breaking update could execute unreviewed code in the agent environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The manifest allows execution of
npx pixcli *andnpx remotion *without version pinning, which can fetch and run whatever package version is current at invocation time. That creates a supply-chain risk: a compromised upstream release, typosquat, or breaking update could execute unreviewed code in the agent environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill encourages users to submit prompts, text, and media to
pixclibut does not prominently warn that these inputs are sent to a remote API service. In an agent setting, this can lead to inadvertent exfiltration of sensitive prompts, proprietary images, internal branding assets, or personal data to a third party.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The documentation instructs users to run
npx pixcli image ...without pinning a version. Even in docs, this encourages execution of the latest package from the registry, exposing users and agents to supply-chain compromise or unexpected behavior changes.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill recommends
npx remotion renderwithout version pinning. This can pull an unreviewed package version at runtime, which is dangerous in agent contexts where command execution may be automated and non-interactive.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The bootstrapping instructions include
npx remotion studiowithout an explicit version. In environments wherenpxresolves remote packages, this creates avoidable supply-chain exposure and undermines reproducibility.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The render example uses unpinned
npx remotion, which can execute whatever version the registry serves at that time. In a skill designed for automated agent use, that increases the risk of arbitrary third-party code execution through dependency drift or compromise.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The image-generation docs allow
--from <path-or-url>and describe API-side classification/routing, but do not explicitly warn that local files, referenced URLs, and prompts may be transmitted to external services. Users or agents may unknowingly send sensitive images, internal URLs, or proprietary prompts to third-party providers, causing privacy or data-governance violations.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-m, --model <model>` | string | auto | Specific model ID (uses advanced endpoint, bypasses auto-classification) | | `-o, --output <path>` | string | auto | Output file or directory path | | `--json` | flag | `false` | Machine-readable JSON output to stdout | | `--no-enrich` | flag | — | Skip prompt enrichment (only with `--model`) | **How it works:** Without `--model`, the API auto-classifies your prompt (icon, photo, illustration, product shot, etc.), enriches it for the best model, and routes it through an optimal pipeline. With `--model`, you bypass classification and go direct. When `--from` is provided, the API uses a `reference_generation` task type — the LLM classifier decides whether images are references for new creation or targets for editing. The enriched prompt and classification are shown in CLI output for debugging.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-m, --model <model>` | string | auto | Specific model ID (uses advanced endpoint, bypasses auto-classification) | | `-o, --output <path>` | string | auto | Output file or directory path | | `--json` | flag | `false` | Machine-readable JSON output to stdout | | `--no-enrich` | flag | — | Skip prompt enrichment (only with `--model`) | **How it works:** Without `--model`, the API auto-classifies your prompt (icon, photo, illustration, product shot, etc.), enriches it for the best model, and routes it through an optimal pipeline. With `--model`, you bypass classification and go direct. When `--from` is provided, the API uses a `reference_generation` task type — the LLM classifier decides whether images are references for new creation or targets for editing. The enriched prompt and classification are shown in CLI output for debugging.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-m, --model <model>` | string | auto | Specific model ID (uses advanced endpoint, bypasses auto-classification) | | `-o, --output <path>` | string | auto | Output file or directory path | | `--json` | flag | `false` | Machine-readable JSON output to stdout | | `--no-enrich` | flag | — | Skip prompt enrichment (only with `--model`) | **How it works:** Without `--model`, the API auto-classifies your prompt (icon, photo, illustration, product shot, etc.), enriches it for the best model, and routes it through an optimal pipeline. With `--model`, you bypass classification and go direct. When `--from` is provided, the API uses a `reference_generation` task type — the LLM classifier decides whether images are references for new creation or targets for editing. The enriched prompt and classification are shown in CLI output for debugging.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-m, --model <model>` | string | auto | Specific model ID (uses advanced endpoint, bypasses auto-classification) | | `-o, --output <path>` | string | auto | Output file or directory path | | `--json` | flag | `false` | Machine-readable JSON output to stdout | | `--no-enrich` | flag | — | Skip prompt enrichment (only with `--model`) | **How it works:** Without `--model`, the API auto-classifies your prompt (icon, photo, illustration, product shot, etc.), enriches it for the best model, and routes it through an optimal pipeline. With `--model`, you bypass classification and go direct. When `--from` is provided, the API uses a `reference_generation` task type — the LLM classifier decides whether images are references for new creation or targets for editing. The enriched prompt and classification are shown in CLI output for debugging.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `-m, --model <model>` | string | auto | Specific model ID (uses advanced endpoint, bypasses auto-classification) | | `-o, --output <path>` | string | auto | Output file or directory path | | `--json` | flag | `false` | Machine-readable JSON output to stdout | | `--no-enrich` | flag | — | Skip prompt enrichment (only with `--model`) | **How it works:** Without `--model`, the API auto-classifies your prompt (icon, photo, illustration, product shot, etc.), enriches it for the best model, and routes it through an optimal pipeline. With `--model`, you bypass classification and go direct. When `--from` is provided, the API uses a `reference_generation` task type — the LLM classifier decides whether images are references for new creation or targets for editing. The enriched prompt and classification are shown in CLI output for debugging.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The edit command accepts one or more source images and sends prompts to backend services, yet the documentation does not disclose that this content leaves the local environment. In a creative pipeline, edited assets may contain PII, confidential designs, customer material, or licensed content, so silent transmission to external processors is a meaningful privacy and compliance risk.
- Content
Static analysis
No suspicious patterns detected.