Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned with Fannabe generation, but it needs Review because it installs an unpinned global CLI and can use cached account credentials to spend credits or access account media.
Install only if you are comfortable with a global npm-installed Fannabe CLI using your cached Fannabe login. Confirm costs before any generation, avoid sensitive images or internal URLs with from-image/upload workflows, and consider installing a pinned CLI version in a contained environment.
## Step 0 — Bootstrap (before anything else)
1. If `fannabe` is not on `$PATH`, install it:
```bash
npm install -g @fannabe/cli
```
Technical Analysis
The bootstrap procedure installs @fannabe/cli from the npm registry without specifying an exact version, lockfile, integrity hash, or verified artifact. Consequently, the effective implementation is mutable and may differ from the package version that existed when this skill was reviewed.
Because npm packages may execute lifecycle scripts during installation, the resolved package can run code with the invoking user's privileges. The global -g installation also modifies shared user-level or system-level Node.js tooling rather than containing the dependency within the project. The CLI source is not included in this repository, so its behavior—including authentication-token handling, API communication, media processing, and update behavior—could not be audited here.
Attack Path
An attacker compromises the npm publisher account, registry distribution path, or a transitive dependency used by @fannabe/cli.
The attacker publishes a malicious release that becomes the version selected by npm's default resolution behavior.
A user or agent follows the mandatory bootstrap instruction and runs npm install -g @fannabe/cli.
Malicious package code executes through an installation lifecycle script or when the installed fannabe executable is invoked.
The payload acts with the installing user's permissions and may access data available to that user.
Impact Assessment
Successful exploitation could permit arbitrary code execution with the invoking user's privileges. The affected scope may include access to the Fannabe authenticati
...[truncated 452 chars]
Remediation
View remediation
Remediation Suggestions
Pin @fannabe/cli to an exact, reviewed version rather than relying on the registry's latest release:
bash
Use the actual approved CLI version; the example version must not be assumed to be valid solely because it matches the skill metadata.
Record and verify the package artifact's integrity hash and npm provenance before installation.
Prefer a project-local installation governed by a committed lockfile over a global installation.
Use --ignore-scripts when the audited package does not require lifecycle scripts. If scripts are required, review them and all transitive dependencies before permitting execution.
Execute the CLI with least privilege in an isolated environment that cannot access unrelated files or credentials.
Restrict the Fannabe token's permissions and lifetime where supported, protect ~/.fannabe with appropriate filesystem permissions, and provide a documented token-revocation procedure.
Establish a controlled upgrade process in which each new CLI release and dependency tree is reviewed before the pinned version is changed.
The skill advertises activation on broad natural-language phrases such as "improve/rewrite this prompt," "describe this photo as a prompt," and account/gallery actions, which can cause the agent to invoke this skill in situations where the user did not clearly intend to spend credits or access Fannabe account data. Because the skill wraps a credit-spending external CLI and can access persistent authenticated state, ambiguous triggering increases the chance of unintended external actions and privacy-impacting account queries.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
91% confidence
Finding
The skill explicitly relies on cached login state in ~/.fannabe and exposes actions like showing the gallery, downloading the latest render, and checking credits. That means a later prompt can leverage an already-authenticated session to access account data or initiate spending without re-authentication, creating a session-persistence risk if invocation is triggered unexpectedly or by a different conversational context.
Content
Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
Use when: "generate an image", "make a video of my model",
"animate this photo", "image-to-video", "motion control / transfer this
dance onto my model", "character swap", "edit/restyle this image",
"caption this video", "improve/rewrite this prompt", "describe this photo
as a prompt", "show my gallery", "download my latest render", or
"how many credits do I have". Wraps the `fannabe` CLI, which runs the same
AI engines, settings, and credit pricing as the Fannabe web studio.
Missing User Warnings
Low
Category
Not specified by scanner
Confidence
86% confidence
Finding
The documented --from-image <path-or-url> feature sends user-supplied image content to vision processing to derive a prompt, but this reference does not warn users that local files or remote URLs may be uploaded and analyzed by an external service. That creates a privacy and data-handling risk: users may unintentionally submit sensitive images or internal URLs without realizing the content leaves their environment.
