ZenMux Image Generation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 5:17 PM UTC
• Version: 1.5.0

Overview

This skill is a straightforward ZenMux image-generation helper, but users should understand that prompts and chosen images are sent to ZenMux.

Install only if you are comfortable sending your prompt text, selected reference images, and ZenMux API key authentication to ZenMux. Avoid using confidential, regulated, or highly sensitive images unless ZenMux's data-handling terms fit your needs. Consider adding HTTP timeouts and response-size checks before heavy use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:67

Finding

Unbounded Remote Request and Response Processing

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.py, lines 67 and 80–82
Vulnerability Type: Missing HTTP timeout and response-size limits
Risk Level: Medium

Vulnerable Code:

python

response = requests.post(url, headers=headers, json=data)

# ...

image_data = base64.b64decode(part['inlineData']['data'])
with open(args.output, "wb") as f:
    f.write(image_data)

Technical Analysis

The outbound HTTP request is made without connect or read timeouts. A remote endpoint that accepts the connection but delays or never completes its response can therefore block the process indefinitely.

The response is also parsed and Base64-decoded without limits on the response body, encoded image field, or decoded image size. Because the response content is controlled by the remote API, a compromised or malfunctioning endpoint could supply excessive data. Buffering the HTTP response, parsing the JSON, decoding the Base64 value, and writing the resulting bytes can consume substantial memory and disk space.

Attack Path

1. A user invokes the documented image-generation script.
2. The script submits the prompt and optional images to the ZenMux endpoint.
3. A compromised or malfunctioning endpoint either stalls the connection or returns an excessively large JSON response containing Base64 data.
4. Because no timeout is configured, a stalled response can leave the process blocked indefinitely.
5. For an oversized response, the script buffers, parses, and decodes the remotely supplied data without enforcing resource limits.
6. The process may exhaust memory, consume excessive disk space, or become unavailable.

Impact Assessment

The issue primarily affects availability. Exploitation can hang the process or exhaust resources available to the invoking user, including memory and writable disk capacity. The decoded content is written with the privileges of the user running the script and to the us ...[truncated 212 chars]

Remediation

View remediation

Remediation Suggestions

• Configure explicit connect and read timeouts, for example:

  python

  response = requests.post(
      url,
      headers=headers,
      json=data,
      timeout=(10, 120),
  )
  response.raise_for_status()
  

• Enforce a maximum acceptable HTTP response size before parsing or decoding it.

• Reject Base64 image fields whose encoded length exceeds a documented limit.

• Estimate and validate the decoded size before calling base64.b64decode.

• Decode and write data using bounded or streaming processing where supported.

• Validate the returned MIME type and image structure before accepting the content.

• Handle timeout, size-limit, JSON-parsing, and Base64-decoding failures separately, ensuring partial output files are removed.

• Consider checking available disk space and writing to a temporary file before atomically replacing the requested output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tainted flow: 'headers' from os.environ.get (line 28, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/generate.py (reported line 69)May include surrounding context.

python

}
    }
    
    response = requests.post(url, headers=headers, json=data)
    
    print(f"Request sent. Response status code: {response.status_code}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of an API key and a remote ZenMux service, but the manifest declares no explicit tool scope or permissions despite requiring environment-variable access and network egress. This creates an authorization and transparency gap: agents or users may invoke a skill with broader capabilities than are clearly declared, increasing the chance of unintended secret exposure or external data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill encourages sending prompts and one or more local reference images to a third-party API but does not warn users that their content will leave the local environment for external processing. This is dangerous because users may provide sensitive images or confidential prompt content without informed consent, leading to privacy, compliance, or data-handling violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.py (reported line 69)May include surrounding context.

python

}
    }
    
    response = requests.post(url, headers=headers, json=data)
    
    print(f"Request sent. Response status code: {response.status_code}")

Static analysis

No suspicious patterns detected.