Make and Model Recognition

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:59 PM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it can send sensitive vehicle images and API credentials to a configurable external endpoint without host or HTTPS safeguards.

Review this skill before installing. Use it only with images you are comfortable sending to TrafficEye, keep TRAFFICEYE_API_URL at the documented HTTPS TrafficEye endpoint unless you trust the alternative deployment, and avoid query-string API-key mode because URLs are commonly logged.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: recognize_road_user.py:240

Finding

Unrestricted API Endpoint Can Receive Sensitive Images and API Credentials

Content

View full analysis

Vulnerability Details

File Location: recognize_road_user.py:240-252, recognize_road_user.py:278-292
Vulnerability Type: Unvalidated network destination and unsafe credential forwarding
Risk Level: Medium

Vulnerable Code

python

image_bytes = image_path.read_bytes()
body, content_type = build_multipart_body(
    fields,
    {file_field: (image_path.name, image_bytes, None)},
)

request_url = build_request_url(api_url, api_key, api_key_mode, api_key_name)
headers = {"Content-Type": content_type, "Content-Length": str(len(body))}
if api_key_mode == "header" and api_key:
    headers[api_key_name] = api_key
elif api_key_mode == "bearer" and api_key:
    headers["Authorization"] = f"Bearer {api_key}"

python

parser.add_argument("image", nargs="?", help="Path to the local image file")
parser.add_argument("--api-url", default=os.getenv("TRAFFICEYE_API_URL", DEFAULT_API_URL))
parser.add_argument("--api-key", default=os.getenv("TRAFFICEYE_API_KEY"))
parser.add_argument(
    "--api-key-mode",
    default=os.getenv("TRAFFICEYE_API_KEY_MODE", DEFAULT_API_KEY_MODE),
    choices=("header", "bearer", "form", "query"),
)
parser.add_argument("--api-key-name", default=os.getenv("TRAFFICEYE_API_KEY_NAME", DEFAULT_API_KEY_NAME))
parser.add_argument("--file-field", default=os.getenv("TRAFFICEYE_FILE_FIELD", DEFAULT_FILE_FIELD))
parser.add_argument("--request-field", default=os.getenv("TRAFFICEYE_REQUEST_FIELD", DEFAULT_REQUEST_FIELD))
parser.add_argument("--request-json", default=os.getenv("TRAFFICEYE_REQUEST_JSON", DEFAULT_REQUEST_JSON))
parser.add_argument("--timeout", type=float, default=float(os.getenv("TRAFFICEYE_TIMEOUT_S", str(DEFAULT_TIMEOUT_S))))
parser.add_argument("--format", choices=("text", "json"), default="text")
parser.add_argument("--response-json-file", help="Read a saved API response instead of calling the API")

Technical Analysis

The Skill must uploa ...[truncated 2850 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured endpoint before building or sending the request.
2. Require the https scheme for every request carrying an image or credential.
3. Reject URLs containing embedded user information or otherwise ambiguous authority components.
4. Allowlist the expected TrafficEye hostname, such as trafficeye.ai, for the default credential.
5. If custom deployments are required, maintain an explicit administrator-configured host allowlist rather than accepting arbitrary destinations.
6. Require explicit user confirmation before transmitting an image to a non-default host.
7. Never forward the TrafficEye credential to a custom host unless that host has been explicitly trusted for that credential.
8. Disable query-string authentication by default and preferably remove it, because URLs are commonly retained in logs and telemetry.
9. Reject all credential-bearing requests over plaintext HTTP.
10. Document that images and license-plate information leave the local system before invoking the live API.
11. Consider implementing separate credential configuration per approved endpoint to prevent accidental cross-service credential disclosure.
12. Add automated tests confirming that HTTP URLs, unapproved hosts, malformed URLs, and credential forwarding to custom hosts are rejected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill performs sensitive actions—reading local files, using environment-provided secrets, and sending data over the network—but does not declare an explicit tool scope or permissions boundary. In an agent ecosystem, this weakens user and platform visibility into what the skill can access, increasing the risk of unintended file exfiltration or overbroad execution without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill sends a local image to a third-party API and extracts vehicle and license-plate data, but the user-facing description does not clearly warn that this data leaves the local environment. Because images and plate data can be highly sensitive personal information, omitting that disclosure undermines informed consent and can lead to privacy and compliance issues if the skill is used on private or regulated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill sends a local image file to a third-party service (TrafficEye) for processing, but the CLI flow does not present an explicit user-facing notice at the point of transmission. Because images may contain personal data such as license plates and surrounding context, users may unknowingly exfiltrate sensitive information off-device, creating privacy, compliance, and consent risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.