Picture it!

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:07 AM UTC
• Version: 1.0.5

Overview

This skill is a disclosed image-generation/editing helper, but users should be careful with the unpinned global npm install and with uploads/costs when using fal.ai.

Install only if you are comfortable using fal.ai for AI image operations and uploading images for generate/edit/remove-bg/upscale. Prefer pinning picture-it to a reviewed exact version, avoid sudo/admin installs, keep FAL_KEY in managed secrets when possible, and use local-only commands when you do not want image data transmitted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-31 and 41-44
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: npm
    package: picture-it
    bins:
      - picture-it

bash

# Install (pick one)
npm install -g picture-it
pnpm add -g picture-it
bun install -g picture-it

Technical Analysis

The skill directs users or an agent runtime to install picture-it from the npm registry without specifying an exact version or verifying package integrity. Consequently, installation resolves to whichever release is current at execution time rather than the version reviewed alongside this skill.

Global npm package installation may execute package lifecycle scripts with the privileges of the invoking user. The installed package and its transitive dependency graph can also change independently of this skill. This creates a supply-chain exposure if the publisher account, registry package, or a transitive dependency is compromised.

Although the skill metadata declares version 0.2.1, the installation instructions do not constrain installation to that version. No malicious dependency is confirmed; the vulnerability is the unsafe, mutable dependency acquisition process.

Attack Path

1. An attacker compromises the picture-it publisher account, package release process, or a dependency included by a future release.
2. The attacker publishes a malicious package version to the npm registry.
3. A user or agent follows the documented unpinned command, such as npm install -g picture-it.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious lifecycle code executes during installation, or malicious application code executes when picture-it is subsequently invoked.
6. The payload operates with the invoking user's privileges and may access files, environment variables, and configuration available to that account.

Impa

...[truncated 631 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to an exact reviewed version in both metadata and examples:

   yaml

   install:
     - kind: npm
       package: picture-it@0.2.1
       bins:
         - picture-it
   

   bash

   npm install --global --save-exact picture-it@0.2.1
   

2. Prefer a project-local installation governed by a committed lockfile over a global installation:

   bash

   npm install --save-exact picture-it@0.2.1
   npx picture-it@0.2.1 --help
   

3. Verify registry provenance and published integrity before approving version updates. Review package lifecycle scripts and the resolved transitive dependency tree.

4. Use lockfile-enforcing installation modes, such as npm ci, in automated environments.

5. Run the CLI under a least-privileged account. Do not install it with sudo or an administrative shell.

6. Expose FAL_KEY only to the process that requires it and avoid retaining unrelated secrets in the same execution environment.

7. Establish a controlled dependency-update process in which new versions are reviewed and tested before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises itself for an extremely broad set of image-related tasks, making it likely to trigger on many common requests beyond narrow, user-explicit invocation. Overly broad activation increases the chance the agent will invoke a networked, cost-incurring, third-party data-transmitting tool unnecessarily, which can lead to privacy exposure, unintended spending, and reduced user control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

- `pixelcut` — Alternative
- `rembg` — Cheapest

## How to Write Good Prompts

This is the difference between mediocre and professional output. Read `references/prompt-library.md` for a full library of tested prompts you can copy and adapt. Key rules:

Static analysis

No suspicious patterns detected.