Grok Image Cli

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:38 PM UTC
• Version: 0.2.1

Overview

This skill has a coherent image-generation purpose, but its installation paths fetch mutable third-party code and expose a global CLI that will handle an API key.

Review this carefully before installing. Prefer a pinned, audited release or a specific verified commit, inspect the npm package/source and dependencies before running install scripts, and avoid installing globally in an environment that contains sensitive files or credentials. Only provide an xAI API key if you trust the exact CLI version you installed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18
• Finding: Unpinned Global Installation of a Mutable Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 18 **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: High ### Vulnerable Code ```bash npm install -g grok-image-cli ``` ### Technical Analysis The Skill instructs users to globally install `grok-image-cli` without specifying an audited package version or integrity hash. Consequently, the package resolved when the command is executed may differ from the package that existed when this Skill was reviewed. An npm installation can execute package lifecycle scripts under the privileges of the invoking user. Global installation also exposes the resulting executable throughout the user's environment. Although the document states that npm provenance is available, the installation command does not enforce provenance verification or bind the package to a reviewed release. The project contains only `SKILL.md`; the installed package's implementation and dependency graph are not included. Therefore, claims regarding credential handling, network destinations, and local data storage cannot be verified from the audited artifact. ### Attack Path 1. An attacker compromises the upstream npm package, a maintainer account, or a dependency used by a future package release. 2. The attacker publishes a malicious release under the existing package name. 3. A user follows the Skill and runs the unpinned global installation command. 4. npm resolves and downloads the malicious release. 5. Malicious lifecycle scripts or package code execute with the invoking user's privileges. 6. The globally installed `grok-img` executable can subsequently access files, environment variables, or credentials available to that user whenever invoked. ### Impact Assessment Successful exploitation could permit arbitrary code execution with the privileges of the user performing the installation. The malicious package could read user-accessible files and environment variables, steal API credentials, alter local c ...[truncated 212 chars]
• Remediation: ## Remediation Suggestions - Pin the npm package to a specific audited version rather than resolving the latest release: ```bash npm install -g grok-image-cli@<reviewed-version> ``` - Record and verify the expected package integrity digest before installation. - Require verification of npm provenance and its association with a reviewed source commit. - Inspect package contents using `npm pack` before execution, including lifecycle scripts and bundled files. - Disable lifecycle scripts during initial inspection where compatible: ```bash npm install --ignore-scripts ``` - Prefer a project-local installation over a global installation to reduce exposure and simplify removal. - Re-audit the package and dependency graph whenever the pinned version is changed.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:26
• Finding: Mutable Source Installation Executes Unreviewed Build and Dependency Scripts## Vulnerability Details **File Location**: `SKILL.md`, lines 26–30 **Vulnerability Type**: Mutable source and dependency execution **Risk Level**: High ### Vulnerable Code ```bash git clone https://github.com/cyberash-dev/grok-image-cli.git cd grok-image-cli npm install && npm run build && npm link ``` ### Technical Analysis The documented source-installation procedure clones the repository's mutable default branch without checking out a fixed commit, signed tag, or verified release. It then resolves dependencies using `npm install`, runs the repository-defined build script, and globally links the resulting executable. The effective code executed by this procedure can change after the Skill has been audited. Both npm lifecycle hooks and the `build` script may execute arbitrary commands with the current user's privileges. The use of `npm install` rather than a frozen installation process also permits dependency resolution to change over time, depending on the upstream manifest and lockfile state. The instruction to audit before running is only advisory and is not enforced by the command sequence. Nothing in the sequence verifies a commit signature, validates dependency integrity independently, or prevents scripts from executing. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, a mutable default-branch dependency reference, or an npm dependency. 2. The attacker modifies project code, package manifests, lifecycle hooks, or the build script. 3. A user executes the documented `git clone` command, retrieving the current compromised branch. 4. `npm install` resolves dependencies and may execute malicious dependency or package lifecycle scripts. 5. `npm run build` executes the attacker-controlled build command. 6. `npm link` globally exposes the compromised CLI, allowing the malicious implementation to execute during later `grok-img` invocations. ### Impact Assessment Exploitation could result in arbitr ...[truncated 504 chars]
• Remediation: ## Remediation Suggestions - Replace the mutable clone procedure with a checkout of a specific reviewed commit or cryptographically verified signed release: ```bash git clone https://github.com/cyberash-dev/grok-image-cli.git cd grok-image-cli git checkout --detach <verified-commit-hash> ``` - Verify the commit or release signature against a trusted maintainer identity. - Use a committed lockfile and `npm ci` instead of `npm install` to enforce deterministic dependency resolution. - Review `package.json`, lifecycle hooks, the lockfile, build scripts, and transitive dependencies before permitting script execution. - Initially install dependencies with scripts disabled where possible, then explicitly run only reviewed scripts. - Avoid `npm link` for production installation; prefer a pinned, scoped, or isolated local installation. - Execute installation and build steps in a sandbox or disposable environment with no production credentials and minimal filesystem permissions. - Re-review the exact commit and locked dependency graph before updating either reference.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.