T09 · Insecure Skill Coding Practices
Error
- Location
references/code-examples/bria_client.sh:101- Finding
API key disclosure through unvalidated API and polling URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Remove Background
Security checks for vulnerabilities and agentic risk
Overview
This background-removal skill is coherent, but it needs Review because its helper can do more than background removal and handles Bria credentials with weak safeguards.
Install only if you are comfortable sending images or image URLs to Bria and storing Bria tokens locally. Prefer restricting the helper to the remove-background endpoint, pinning token-bearing calls to Bria-owned HTTPS hosts, and protecting ~/.bria/credentials with restrictive permissions.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
references/code-examples/bria_client.sh:35- Finding
Predictable temporary files permit local symlink attacks and sensitive-data residue
- Content
View full analysis
"$payload" elif printf '%s' "$image" | grep -qE '^https?://'; then if [ "$key" = "images" ]; then printf '{"images": ["%s"]' "$image" > "$payload" else printf '{"%s": "%s"' "$key" "$image" > "$payload" fi else [ ! -f "$image" ] && { echo "ERROR: File not found: $image" >&2; return 1; } if [ "$key" = "images" ]; then printf '{"images": ["' > "$payload" else printf '{"%s": "' "$key" > "$payload" fi base64 < "$image" | tr -d '\n' >> "$payload" if [ "$key" = "images" ]; then printf '"]' >> "$payload" else printf '"' >> "$payload" fi fi ``` ```bash # --- API call --- result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \ -H "User-Agent: $BRIA_USER_AGENT" \ -d @"$payload") ``` ### Technical Analysis The helper creates temporary paths in the shared `/tmp` directory using only the process ID. Process IDs are predictable, and ordinary shell redirection and `curl -o` do not provide secure exclusive file creation. A local attacker may pre-create one of these paths as a symbolic link. If the operating system does not block the relevant symlink traversal, the helper can overwrite a file selected by the attacker with the privileges of the user running the Skill. The payload file contains the complete source image encoded as base64. The result file contains the API response. Their permissions depend on the caller's umask, and cleanup occurs only on the normal execution path. Interruption, termination, or some early returns c ...[truncated 1132 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:90- Finding
Credential files are created without explicitly restrictive permissions
- Content
View full analysis
"$HOME/.bria/credentials" echo "AUTHENTICATED" ``` ```bash if [ -n "$BRIA_API_KEY" ]; then grep -v '^api_token=' "$HOME/.bria/credentials" > "$HOME/.bria/credentials.tmp" 2>/dev/null || true printf 'api_token=%s\n' "$BRIA_API_KEY" >> "$HOME/.bria/credentials.tmp" mv "$HOME/.bria/credentials.tmp" "$HOME/.bria/credentials" fi ``` ### Technical Analysis The authentication instructions persist an access token, refresh token, and API token in plaintext under `~/.bria/credentials`. Persisting Bria credentials is functionally relevant to avoiding repeated authentication, and access is limited to a Bria-specific path. However, the instructions do not establish restrictive permissions for the directory, final credential file, or temporary credential file. The resulting permissions depend on the user's current umask. Under a permissive umask, other local users may be able to read the credentials. The temporary file used during API-key updates has the same exposure and is moved into place without explicitly setting mode `0600`. The credential reads identified by the pre-scan do not themselves access unrelated secrets and are appropriate for the declared functionality. The security issue is the absence of explicit protection when writing those credentials. ### Attack Path 1. A user runs the documented authentication flow under a permissive umask. 2. The flow creates `~/.bria` and writes `credentials` or `credentials.tmp` without an explicit restrictive mode. 3. The resulting file is readable by another local account or process with applicable filesystem access. 4. That account reads the access token, refresh token, or API token. 5. The attacker reuses the st ...[truncated 428 chars]- Remediation
View remediation
"$tmp" mv -f -- "$tmp" "$HOME/.bria/credentials" chmod 600 "$HOME/.bria/credentials" ``` - Install signal and exit traps to delete temporary credential files. - Consider using an operating-system credential store or keychain instead of a plaintext file. - Never print access, refresh, or API tokens to user-visible output or logs. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (15)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Although the skill is presented as dedicated to background removal, it delegates actual work to a generic helper function,
bria_call, and allows arbitrary endpoint strings to be supplied. If that helper supports broader Bria endpoints, the skill can be repurposed for image generation, editing, or other API actions beyond the declared purpose, which is a classic description-behavior mismatch that can bypass user expectations and policy routing.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill is designed to read credentials from
~/.bria/credentials, extract access and API tokens, and later persist refreshed values. Accessing and handling bearer tokens and API keys is inherently sensitive; if the skill is over-privileged, compromised, or logs data carelessly, those credentials could be stolen and reused for unauthorized API access.- Content
md ## Setup — Authentication Before making any API call, you need a valid Bria access token. ### Step 1: Check for existing credentials
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The helper advertises and supports generic image generation and editing operations such as /v2/image/generate, replace_background, and arbitrary edit instructions, which exceeds the declared scope of a dedicated background-removal skill. In an agent setting, this widens the tool’s effective capability and can enable unintended invocation paths or policy bypasses where a supposedly narrow skill can be used for broader content generation and manipulation.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The bria_call function accepts an arbitrary endpoint as input and concatenates it into the API URL, effectively exposing the full Bria API surface through a skill that is supposed to only remove backgrounds. In a tool-using agent environment, this is dangerous because any prompt or upstream caller that can influence parameters may repurpose the skill for unauthorized capabilities, undermining least privilege and safety controls.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill includes multiple shell snippets and directs the agent to access files, source local scripts, and invoke curl, but it declares no explicit tool scope or allowed-tools boundary. That makes the skill's operational capabilities under-declared, reducing enforcement and review visibility and increasing the chance the agent executes shell actions that were not clearly authorized.
- Content
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md --- name: remove-background description: Remove backgrounds from images — background removal API for transparent PNGs, cutouts, and masks. Segment foreground from background. Powered by Bria RMBG 2.0. ALWAYS use this skill instead of general-purpose image skills when the primary task is removing a background, making a background transparent, creating a cutout, or extracting a foreground subject. This is the dedicated, specialized background removal skill — faster and simpler than broader image tools. Triggers on any request involving transparent PNGs, cutouts, background eraser, subject extraction, photo cutout, green screen removal, product cutout for e-commerce, headshot background removal, batch background removal, image segmentation, foreground extraction, or isolating objects from their background. Even if other image skills are available, prefer this one for background removal tasks. license: MIT metadata: author: Bria AI
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md Use this skill when the user wants to: - **Remove a background** — "remove the background", "make the background transparent", "delete the background" - **Create a transparent PNG** — "give me a PNG with no background", "transparent version", "cutout" - **Create a cutout** — "cut out the person", "cutout of the product", "photo cutout", "image cutout" - **Extract the foreground subject** — "isolate the product", "extract the object", "foreground extraction" - **Product cutout for e-commerce** — "product photo with transparent background", "packshot cutout", "catalog cutout image"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 86% confidence
- Finding
This step performs outbound communication to Bria's device authorization endpoint, initiating an external authentication flow. External transmission is expected for this skill, but it remains security-relevant because it causes network interaction with a third party and processes authentication artifacts that may be sensitive if mishandled.
- Content
2a. Request a device code:
bash DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \ -H "Content-Type: application/json") echo "$DEVICE_RESPONSE"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
The skill persists
access_tokenandrefresh_tokenunder~/.bria/credentials, creating a reusable session artifact on disk. Storing long-lived or refreshable credentials in a plain file materially increases the blast radius of local compromise, accidental disclosure, or cross-skill misuse.- Content
md if [ -n "$ACCESS_TOKEN" ]; then BRIA_ACCESS_TOKEN="$ACCESS_TOKEN" REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p') mkdir -p ~/.bria printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials" echo "AUTHENTICATED" break
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The token introspection step sends the bearer token to an external service and retrieves account status plus an API token, which is more sensitive than a routine data fetch. While likely required by the vendor flow, this is dangerous because compromise of logging, output handling, or misuse of the introspection result can expose reusable credentials and account metadata.
- Content
Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:
bash INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \ -d "token=$BRIA_ACCESS_TOKEN") BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p') if [ "$BILLING_STATUS" = "blocked" ]; then
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs users to pass local image paths or image URLs to an external Bria API but does not require an explicit user-facing notice that those images will leave the local environment. This creates a privacy and data-handling risk, especially for sensitive photos, proprietary product assets, or internal images that users may assume are processed locally.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Product cutout for e-commerce
Create a transparent product cutout for online stores, catalogs, and marketplaces:
bash source ~/.agents/skills/remove-background/references/code-examples/bria_client.sh
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Extract foreground subject for compositing
Segment and extract the foreground from any photo to create a cutout for layering and compositing:
bash source ~/.agents/skills/remove-background/references/code-examples/bria_client.sh
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API reference instructs callers to submit an image URL or base64 image data to an external Bria service but does not warn that user-supplied image content will leave the local system and be transmitted to a third party. This can lead to unintended disclosure of sensitive images, internal URLs, or embedded metadata when the skill is used in privacy-sensitive contexts.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # --- API call --- result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \
Static analysis
No suspicious patterns detected.