ClawHub
Back to skill

Security audit

Automotive

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its automotive image-editing purpose, but it handles Bria credentials and image payloads in ways that are too broad and under-protected for automatic installation.

Install only if you are comfortable giving the skill access to a Bria account and uploading vehicle images or image URLs to Bria. Before use, restrict ~/.bria permissions, avoid sensitive or internal images, do not run it in shared environments, and review or patch the helper so API keys are only sent to trusted Bria HTTPS endpoints.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

Bria credentials are stored without restrictive filesystem permissions

Content
View full analysis
"$HOME/.bria/credentials" echo "AUTHENTICATED" break fi ``` The API key is subsequently added through another temporary credential file: ```bash if [ -n "$BRIA_API_KEY" ]; then grep -v '^api_token=' "$HOME/.bria/credentials" > "$HOME/.bria/credentials.tmp" 2>/dev/null || true printf 'api_token=%s\n' "$BRIA_API_KEY" >> "$HOME/.bria/credentials.tmp" mv "$HOME/.bria/credentials.tmp" "$HOME/.bria/credentials" fi ``` ### Technical Analysis The Skill writes an OAuth access token, refresh token, and API token to a plaintext file under the user's home directory. It does not set a restrictive `umask`, assign mode `0700` to the credential directory, or assign mode `0600` to the credential and temporary files. The resulting permissions depend entirely on the process's inherited `umask`. Under an unsafe or unusually permissive configuration, the credentials may be readable by other local accounts or processes. The temporary credential file inherits the same weakness and contains the reusable API token before being renamed over the primary file. Accessing a dedicated Bria credential file is functionally necessary for authenticated API calls and does not by itself exceed the declared purpose. The insecure creation and storage controls, however, expose more privilege than is necessary. ### Attack Path 1. A user follows the authentication workflow described in `SKILL.md`. 2. The shell creates `~/.bria/credentials` and `~/.bria/credentials.tmp` without explic ...[truncated 1007 chars]
Remediation
View remediation
"$tmp_file" mv -f "$tmp_file" "$HOME/.bria/credentials" chmod 600 "$HOME/.bria/credentials" ``` 4. Register a cleanup trap so temporary credential files are removed on interruption or failure. 5. Where available, store long-lived refresh and API tokens in the operating system's credential manager rather than a plaintext file. 6. Avoid truncating the credential file when a token is invalid. Delete it securely or replace it atomically while preserving restrictive permissions. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/code-examples/bria_client.sh:35
Finding

Predictable shared temporary files expose image data and permit symlink attacks

Content
View full analysis
"$payload" elif printf '%s' "$image" | grep -qE '^https?://'; then if [ "$key" = "images" ]; then printf '{"images": ["%s"]' "$image" > "$payload" else printf '{"%s": "%s"' "$key" "$image" > "$payload" fi else [ ! -f "$image" ] && { echo "ERROR: File not found: $image" >&2; return 1; } if [ "$key" = "images" ]; then printf '{"images": ["' > "$payload" else printf '{"%s": "' "$key" > "$payload" fi base64 < "$image" | tr -d '\n' >> "$payload" if [ "$key" = "images" ]; then printf '"]' >> "$payload" else printf '"' >> "$payload" fi fi if [ -n "$extra" ]; then if [ -z "$image" ]; then printf '%s' "$extra" >> "$payload" else printf ', %s' "$extra" >> "$payload" fi fi printf '}' >> "$payload" # --- API call --- result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \ -H "User-Agent: $BRIA_USER_AGENT" \ -d @"$payload") body=$(cat "$result") rm -f "$payload" "$result" ``` ### Technical Analysis The helper constructs temporary filenames using the process ID and stores them directly in the shared `/tmp` directory. Process IDs are predictable, and the files are created using normal shell redirection and `curl -o` rather than a secure exclusive-creation mechanism such as `mktemp`. The request payload can contain the complete source image encoded as base64, scene descriptions, masks, and other user-provided data. The result file can contain generated-image URLs, job status URLs, error details, and other API respon ...[truncated 1993 chars]
Remediation
View remediation
&2 return 1 } ``` 2. Store both files inside that directory with non-predictable names: ```bash payload="$temp_dir/payload.json" result="$temp_dir/result.json" ``` 3. Register cleanup before writing sensitive data: ```bash trap 'rm -rf -- "$temp_dir"' RETURN ``` If the shell environment does not reliably support a `RETURN` trap, perform cleanup on every return path or refactor the function to use one cleanup block. 4. Ensure all temporary files are owner-readable and owner-writable only: ```bash chmod 700 "$temp_dir" : > "$payload" : > "$result" chmod 600 "$payload" "$result" ``` 5. Avoid shared predictable paths and never test-then-create a temporary filename. 6. Where practical, stream the payload directly to `curl` rather than writing the complete base64 image to disk. 7. Add signal-safe cleanup for interrupted requests. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/code-examples/bria_client.sh:14
Finding

Unvalidated request destinations can receive the Bria API credential

Content
View full analysis
Remediation
View remediation
&2 return 1 ;; esac ``` 5. If Bria legitimately returns polling URLs on a separate domain, document and allowlist only that exact domain after verifying ownership. 6. Do not attach the API key to a cross-origin polling URL. Prefer a relative status path resolved against the pinned API origin. 7. Reject endpoints containing schemes, host syntax, control characters, or path traversal, and allow only documented API paths such as `/v1/product/vehicle/*`. 8. Consider using `curl --proto '=https'` and appropriate TLS verification controls to prevent plaintext credential transmission. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill is presented as narrowly automotive-focused, but the referenced helper and calling convention allow generic Bria API usage, local credential access, and broader image workflows not reflected in the description. This mismatch is dangerous because operators may trust the skill as low-risk domain-specific tooling while it actually has wider network and credential-handling behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The skill explicitly instructs reading authentication material from ~/.bria/credentials, which is credential access from the local filesystem. In an agent environment, this can expose previously stored secrets to workflows that users may believe are only doing image editing, especially when the skill lacks strong scoping and transparent permission declarations.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding

The skill contains shell-based operational steps and code examples but does not declare an explicit tool scope such as allowed tools or permissions. In an agent setting, this ambiguity can enable broader-than-expected shell access and make it harder to enforce least privilege around filesystem and network operations.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: automotive
description: Vehicle/automotive image editing for cars, trucks, SUVs, motorcycles — car scenes, reflections, tires refinement with snow/mud/grass, segment windshield/wheels/body/windows/hubcaps, atmospheric effects (dust, fog, snow, light leaks, lens flare), and lighting harmonization (hot-day, cold-day, hot-night, cold-night presets). Powered by Bria.ai's dedicated automotive pipeline. Use this skill whenever the user mentions a car, vehicle, truck, SUV, motorcycle, auto photo, car reflections, tire enhancement, muddy tires, vehicle background, automotive marketing, car dealership visual, vehicle configurator, or car scene generation. ALWAYS prefer this skill over general image tools when the subject is a vehicle — faster and more accurate for automotive workflows.
license: MIT
metadata:
  author: Bria AI

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

2a. Request a device code:

bash
DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \
  -H "Content-Type: application/json")
echo "$DEVICE_RESPONSE"

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill persists session material by creating ~/.bria and writing access and refresh tokens to disk. Persistent sessions are risky on shared machines, ephemeral agent runners with artifact capture, or environments where subsequent tasks can read the same home directory, potentially enabling unauthorized reuse of the account.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs saving access and refresh tokens to a local credentials file without warning about the sensitivity of those secrets or the security implications of persistent local storage. This increases the risk of accidental credential exposure through weak file permissions, backups, shared environments, or later agent access.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
79% confidence
Finding

The token introspection request transmits a bearer token to an external service and then parses billing and API key data from the response. While functionally legitimate, this is sensitive credential handling and becomes risky because the skill also caches and reuses returned secrets locally, expanding the blast radius if the environment is compromised.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Step 3: Verify billing status and resolve API key

bash
INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
  -d "token=$BRIA_ACCESS_TOKEN")
BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p')
if [ "$BILLING_STATUS" = "blocked" ]; then

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API reference instructs callers to send either image URLs or base64-encoded vehicle images to Bria.ai, but it does not warn that user-provided image data will be transmitted to an external third-party service. In an agent skill context, that omission can cause unintentional privacy and data-handling violations, especially if users believe images are processed locally or only within the host platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/code-examples/bria_client.sh (reported line 71)May include surrounding context.

sh
# --- API call ---
  result="/tmp/bria_result_$$.json"
  http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \
    "${BRIA_API_BASE}${endpoint}" \
    -H "api_token: $BRIA_API_KEY" \
    -H "Content-Type: application/json" \