Security audit

pixmind-image

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Pixmind image-generation purpose, but it sends Pixmind credentials and user prompts to a different disclosed domain and logs sensitive prompt/result data.

Install only if you are comfortable with Pixmind prompts, reference-image URLs, and the PIXMIND_API_KEY being used with the documented aihub-admin.aimix.pro endpoint. Prefer the native Pixmind Builder tools over the fallback scripts, avoid sensitive prompts or signed private image URLs, and be aware that fallback script output may be retained in terminal or agent logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: image-generate.js:42
Finding: API Credential and User Content Sent Across an Unverified Domain Trust Boundary
Content: View full analysis
`. ``` From `image-generate.js:42-46, 64-68`: ```javascript const apiKey = process.env.PIXMIND_API_KEY; if (!apiKey) { console.error('Error: PIXMIND_API_KEY not set. Get one at https://www.pixmind.io/api-platform/dashboard/keys'); process.exit(1); } const res = await fetch(`${API_BASE}/api-platform/v1/generations`, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}` }, body: JSON.stringify(body), }); ``` The destination is defined at `image-generate.js:1`: ```javascript const API_BASE = 'https://aihub-admin.aimix.pro'; ``` From `task-status.js:34-38, 44-46`: ```javascript const apiKey = process.env.PIXMIND_API_KEY; if (!apiKey) { console.error('Error: PIXMIND_API_KEY not set. Get one at https://www.pixmind.io/api-platform/dashboard/keys'); process.exit(1); } const res = await fetch(`${API_BASE}/api-platform/v1/tasks/${opts.taskId}`, { headers: { 'Authorization': `Bearer ${apiKey}` }, }); ``` ### Technical Analysis The fallback scripts instruct users to obtain or manage a credential associated with `pixmind.io`, but transmit that credential as a reusable bearer token to `aihub-admin.aimix.pro`. The repository does not document or independently establish the operational relationship between these domains. The generation request also transfers the user's prompt, generation para ...[truncated 1775 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: image-generate.js:59
Finding: Sensitive Prompts and Complete API Responses Are Written to Process Logs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: task-status.js:40
Finding: Fallback Scripts Do Not Enforce Generation Cost Bounds or Safe Polling Limits
Content: View full analysis
c.toUpperCase()); if (args[i] === '--enhance') { opts.enhancePrompt = true; } else if (i + 1 < args.length && !args[i + 1].startsWith('--')) { opts[key] = args[++i]; } } } return opts; } ``` From `image-generate.js:48-56`: ```javascript const body = { type: 'image', prompt: opts.prompt, model: opts.model || 'gpt-image-2', aspectRatio: opts.aspectRatio || '1:1', sampleCount: parseInt(opts.count) || 1, enhancePrompt: opts.enhancePrompt || false, generateType: opts.type || 'text2img', }; ``` From `task-status.js:20-30`: ```javascript function parseArgs(args) { const opts = {}; for (let i = 0; i < args.length; i++) { if (args[i].startsWith('--')) { if (args[i] === '--poll') { opts.poll = true; } else if (i + 1 < args.length && !args[i + 1].startsWith('--')) { const key = args[i].slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase()); opts[key] = args[++i]; } } } return opts; } ``` From `task-status.js:40-41, 49-70`: ```javascript const poll = opts.poll; const interval = parseInt(opts.interval) || 3000; async function pollStatus() { while (true) { const result = await checkStatus(); const data = result.data || result; const status = data.status || 'unknown'; const progress = data.progress || 0; console.log(`[${new Date().toISOString()}] Status: ${status} | Progress: ${progress}%`); if (status === 'ready' || status === 'success' ...[truncated 2651 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description says the skill should generate or edit AI images through Pixmind. However, this code chunk only fetches task status from a Pixmind-related API endpoint using a task ID and API key, with optional polling until completion. Its primary function is monitoring asynchronous task progress, not initiating image generation or editing. It also handles videoUrl and coverUrl outputs, which goes beyond the stated image-focused description. This is a material description-behavior mismatch rather than a mere supporting implementation detail.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase 'or whenever the user asks to create or modify an image through Pixmind' is broad enough to activate on many ordinary image-related requests, increasing the chance of this skill being invoked when a simpler or safer path would suffice. Over-broad activation can cause unintended paid API calls, unnecessary external data sharing to the provider, or bypass of more specialized review before image generation/editing occurs.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The description embeds Chinese-only task phrases ("文生图、图生图、图片编辑...") as part of the invocation guidance, but does not state that this is optional, illustrative, or region-specific. That can be read as privileging a specific language/locale without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The help text, examples, and runtime status/error messages in this script are hard-coded in English, with no indication that users can select another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: image-generate.js:47

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: task-status.js:39