T09 · Insecure Skill Coding Practices
Error
- Location
references/code-examples/bria_client.sh:14- Finding
Bria API Credential Disclosure Through Unvalidated Request Destinations
- Content
View full analysis
- Remediation
View remediation
Security audit
test-should-be-removed
Security checks for vulnerabilities and agentic risk
Overview
This Bria image API skill is purpose-aligned, but it needs review because it broadly routes image work to a third-party service and handles persistent API credentials in ways that could leak them.
Install only if you are comfortable sending prompts and images to Bria.ai and storing Bria credentials on this machine. Use it on a single-user trusted environment, protect or remove ~/.bria/credentials when not needed, avoid sensitive personal or proprietary images unless approved, and review the shell helper before using any non-default API base or async status URL behavior.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:107- Finding
OAuth and API Credentials Are Stored Without Explicit Restrictive Permissions
- Content
View full analysis
"$HOME/.bria/credentials" echo "AUTHENTICATED" ``` ```bash grep -v '^api_token=' "$HOME/.bria/credentials" > "$HOME/.bria/credentials.tmp" 2>/dev/null || true printf 'api_token=%s\n' "$BRIA_API_KEY" >> "$HOME/.bria/credentials.tmp" mv "$HOME/.bria/credentials.tmp" "$HOME/.bria/credentials" ``` ### Technical Analysis The authentication procedure persists an OAuth access token, refresh token, and API token in a plaintext file. Storing these credentials is directly related to the declared authentication functionality, but the file and containing directory are created without an explicit restrictive `umask` or permission mode. Shell redirection normally creates files according to the process umask. Under an unusually permissive umask, the credential file or its temporary replacement may be readable by other local users. The temporary file used when adding `api_token` has the same issue and is moved into place without first enforcing mode `0600`. This credential access does not exceed the functional scope of the Skill: it reads and writes only the declared `~/.bria/credentials` path. The vulnerability is the absence of explicit access controls, not the use of that credential path itself. ### Attack Path 1. The Skill is run in a multi-user environment with a permissive umask. 2. Device authentication succeeds. 3. The shell creates `~/.bria/credentials`, or later creates `~/.bria/credentials.tmp`, with permissions derived from that umask. 4. Another local account reads the access token, refresh token, or API token. 5. The attacker reuses the exposed credential to issue requests under the victim's Bria account. Exploitation requires local access sufficient to t ...[truncated 536 chars]- Remediation
View remediation
"$tmp" mv -f "$tmp" "$HOME/.bria/credentials" ``` - Register cleanup for temporary files on interruption. - Where available, prefer an operating-system credential store or keychain over plaintext storage. - Verify existing credential-file ownership and permissions before reading it; refuse files owned by another user or writable by group/others. ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
references/code-examples/bria_client.sh:36- Finding
Predictable Shared Temporary Files Enable Symlink Attacks and Image Disclosure
- Content
View full analysis
"$payload" elif printf '%s' "$image" | grep -qE '^https?://'; then if [ "$key" = "images" ]; then printf '{"images": ["%s"]' "$image" > "$payload" else printf '{"%s": "%s"' "$key" "$image" > "$payload" fi else [ ! -f "$image" ] && { echo "ERROR: File not found: $image" >&2; return 1; } if [ "$key" = "images" ]; then printf '{"images": ["' > "$payload" else printf '{"%s": "' "$key" > "$payload" fi base64 < "$image" | tr -d '\n' >> "$payload" if [ "$key" = "images" ]; then printf '"]' >> "$payload" else printf '"' >> "$payload" fi fi if [ -n "$extra" ]; then if [ -z "$image" ]; then printf '%s' "$extra" >> "$payload" else printf ', %s' "$extra" >> "$payload" fi fi printf '}' >> "$payload" ``` The same implementation subsequently uses another predictable process-ID-based path: ```bash result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \ -H "User-Agent: $BRIA_USER_AGENT" \ -d @"$payload") body=$(cat "$result") rm -f "$payload" "$result" ``` ### Technical Analysis The helper constructs temporary filenames in the globally shared `/tmp` directory using only its process ID. Process IDs are observable or predictable, and ordinary output redirection does not provide secure exclusive creation. A local attacker can pre-create a symbolic link at the anticipated path. When the helper writes the payload or when `curl -o` writes the result, the operation can follow that link. Depending on the target file and the victim's permissions, this can overwrite or corrupt a file accessi ...[truncated 1683 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The code is clearly related to Bria image API usage, so the overall domain matches the description. However, the description claims a fuller skill with OAuth device-flow authentication, credential caching behavior, and a wide catalog of image-manipulation capabilities. This code chunk only implements a generic authenticated API caller: it reads an existing API token from ~/.bria/credentials if present, constructs request payloads, sends POST requests, and polls async jobs. It does not implement OAuth device flow, does not itself cache credentials, and does not demonstrate the many specific operations beyond being usable with arbitrary endpoints. Because key declared functionality is not actually present in the supplied code chunk, the description overstates what this code does.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The skill directly accesses and processes highly sensitive credentials including access tokens, refresh tokens, and API keys. Because these secrets are read from and written to predictable filesystem locations, any over-privileged agent action, logging mistake, or local compromise could expose reusable credentials for unauthorized API use.
- Content
md ## Setup — Authentication Before making any API call, you need a valid Bria access token. ### Step 1: Check for existing credentials
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill embeds shell-based authentication and API invocation guidance but does not declare any explicit tool scope or allowed-tools boundary. That makes its operational privileges ambiguous and increases the risk that an agent could invoke shell/network actions more broadly than intended when the skill is selected.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The description explicitly advertises credential caching in ~/.bria/credentials, indicating persistent session material beyond the immediate task. Persistent authentication increases the blast radius of a local compromise and may cause future agent runs to inherit access without renewed user awareness or consent.
- Content
md --- name: bria-ai description: AI image generation, editing, and background removal API via Bria.ai — authenticates via OAuth device flow and caches credentials in ~/.bria/credentials, then calls 20+ endpoints to remove backgrounds for transparent PNGs and cutouts, generate images from text prompts, and edit photos with natural language instructions. Also create product photography and lifestyle shots, replace or blur backgrounds, upscale resolution, restyle, and batch-generate visual assets. Use this skill whenever the user wants to remove a background, create transparent PNGs, generate, edit, modify, or transform any image — including hero images, banners, social media visuals, product photos, illustrations, icons, thumbnails, ad creatives, or marketing materials. Also triggers on cutout, inpainting, outpainting, object removal or addition, photo restoration, style transfer, image enhancement, relight, reseason, sketch-to-photo, or any visual content creation. Commercially safe, royalty-free. license: MIT homepage: https://bria.ai metadata:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs storage of access, refresh, and API tokens in ~/.bria/credentials without clearly warning the user that long-lived credentials will be written to disk. Local credential persistence raises theft and misuse risk on shared or compromised systems, especially for refresh tokens that can mint new access tokens.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The activation guidance is extremely broad, effectively claiming almost any image-related request. Over-broad triggering can cause the agent to unnecessarily route user content, files, or prompts to an external third-party API, increasing privacy, consent, and data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2a. Request a device code:
bash DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \ -H "Content-Type: application/json") echo "$DEVICE_RESPONSE"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
This code persists both access and refresh tokens to ~/.bria/credentials, creating durable authentication state on disk. Refresh tokens are particularly sensitive because they can re-establish access after access-token expiry, making theft materially more damaging than transient session handling.
- Content
md if [ -n "$ACCESS_TOKEN" ]; then BRIA_ACCESS_TOKEN="$ACCESS_TOKEN" REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p') mkdir -p ~/.bria printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials" echo "AUTHENTICATED" break
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
The token introspection request transmits the bearer access token to a remote service and then derives an API token from the response. While expected for this integration, it is still sensitive credential transmission; if triggered without clear consent or proper containment, it increases account compromise risk and expands exposure of secrets to external systems.
- Content
Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:
bash INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \ -d "token=$BRIA_ACCESS_TOKEN") BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p') if [ "$BILLING_STATUS" = "blocked" ]; then
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This reference instructs clients to send API tokens, image URLs/base64 image content, and free-form prompts to a third-party service but provides no privacy, retention, or data-handling warning. In an image-processing skill, users may submit sensitive photos or proprietary creative assets, so the omission can lead to uninformed disclosure of personal or confidential data to an external processor.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh # --- API call --- result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script automatically reads BRIA_API_KEY from ~/.bria/credentials and then uses it in outbound HTTP requests. While the header comment mentions auto-loading, there is no runtime notice, prompt, or other user-facing disclosure at the point of use for this sensitive credential access and transmission.
- Content
Static analysis
No suspicious patterns detected.