ClawHub
Back to skill

Security audit

GPT Image 2 Prompt Architect

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent prompt-writing helper, but its optional MCP setup runs an unpinned GitHub package and can send user prompt details to an external service without enough privacy controls.

Use the text-only prompt workflow freely. Treat the optional Image3 MCP as an informed opt-in: review or pin the GitHub package before installing it, and avoid sending confidential briefs, personal details, unreleased product plans, private URLs, customer names, or proprietary campaign text through the external prompt-search tools.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:90
Finding

Unpinned Third-Party MCP Installation Enables Mutable Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-98
Vulnerability Type: Unpinned external dependency and remote code execution
Risk Level: High

Vulnerable Code:

bash
Install the read-only MCP in OpenClaw:

openclaw mcp add image3 \
  --command npx \
  --arg -y \
  --arg github:gpt-img-2/image3-prompt-mcp \
  --include 'search_prompts,get_prompt,list_categories,build_prompt_brief'

openclaw mcp doctor image3 --probe

Technical Analysis

The Skill instructs users to execute an MCP package directly from a mutable GitHub repository through npx -y. The dependency is not pinned to an immutable commit, release version, or verified checksum. Consequently, the code executed at installation time may differ from the code that was reviewed during the Skill audit.

The -y argument suppresses package-installation confirmation. Although the documentation describes the MCP as read-only, the installation command itself does not enforce that property. The downloaded package executes with the permissions of the user or Agent process invoking npx.

This behavior is not required for the Skill's primary text-only prompt-authoring functionality. It introduces an executable supply-chain dependency and therefore exceeds the minimum privileges necessary for the core declared function.

Attack Path

  1. An attacker compromises the referenced GitHub repository, a maintainer account, or its dependency chain.
  2. The attacker modifies the repository content or dependency metadata while retaining the same repository identifier.
  3. A user or Agent follows the documented installation command.
  4. npx -y retrieves the current mutable repository content without requiring interactive approval.
  5. The attacker-controlled package executes under the invoking process's local privileges.
  6. The malicious process can access resources available to that account, subject to host sandboxing and operating-system ...[truncated 535 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the MCP to a reviewed, immutable commit SHA or cryptographically identified release.
  • Publish and verify a checksum or signed provenance record before installation.
  • Remove automatic -y execution so users can review the package and installation source.
  • Prefer a locally reviewed and vendored dependency where feasible.
  • Run the MCP in a restricted sandbox with:
    • Read-only filesystem access unless explicitly required.
    • No access to unrelated environment variables or credentials.
    • A strict outbound-network allowlist.
    • Resource and process-execution limits.
  • Document the exact permissions, endpoints, and data flows required by the MCP.
  • Keep the local text-only workflow as the default and make installation an explicit, informed opt-in.

other

Warning
Location
SKILL.md:79
Finding

External Prompt Search May Disclose Sensitive User Content Without Consent or Redaction

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-88
Vulnerability Type: External disclosure of user-provided content
Risk Level: Medium

Vulnerable Code:

md
## Optional Image3 Prompt MCP

When the Image3 MCP tools are available, use them only when real examples or gallery research would materially improve the answer:

1. Call `search_prompts` with the user's task, language, and a focused result limit.
2. Present concise candidates with title, preview, and canonical Image3 source URL.
3. Call `get_prompt` only for the selected candidate; do not bulk-fetch the library.
4. Use `build_prompt_brief` when the user's idea is rough, then adapt the result with the prompt construction rules below.
5. Use `list_categories` only when the user is exploring rather than asking for a specific result.

Technical Analysis

The workflow directs the Agent to pass the user's task and language to an optional externally sourced MCP when gallery research may improve the answer. Image-generation briefs can contain confidential product details, unreleased campaigns, personal descriptions, proprietary brand information, or text intended to appear in private materials.

The Skill does not require explicit user consent before external transmission. It also provides no mandatory sensitivity assessment, redaction procedure, data-minimization rule, destination disclosure, retention policy, or prohibition against sending secrets and personal data.

External research can be relevant to the optional prompt-gallery feature, but transmitting the full user task is not necessary for the core prompt-rewriting workflow. Even for gallery search, sanitized keywords would generally provide a lower-privilege alternative.

Attack Path

  1. A user supplies an image brief containing confidential, personal, or proprietary details.
  2. The Agent determines that external examples would materially improve the answer.
  3. Following t ...[truncated 1018 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user consent before invoking any network-backed prompt-search tool.
  • Clearly identify the external destination and explain what fields will be transmitted.
  • Default to the local text-only workflow.
  • Send only sanitized search keywords instead of the complete user task.
  • Remove secrets, personal data, private URLs, customer names, unreleased product identifiers, and proprietary text before transmission.
  • Add a mandatory sensitivity check that blocks external calls when confidential content is detected.
  • Document the service's retention, logging, deletion, and subprocessors policies.
  • Provide a local-only option that remains fully functional without installing or contacting the MCP.
  • Enforce outbound-network restrictions so the MCP can communicate only with documented endpoints.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
- Demo: https://image3.org/models/gpt-image-2
- Create: https://image3.org/ai-image
- Prompt gallery: https://image3.org/prompts/gpt-image-2
- Raw SKILL.md: https://image3.org/skills/gpt-image-2-prompt-architect/SKILL.md
- Prompt guide: https://image3.org/blog/gpt-image-2-prompt-guide
- Product photo prompts: https://image3.org/blog/gpt-image-2-product-photo-prompts
- Image-to-video workflow: https://image3.org/blog/gpt-image-2-image-to-video-workflow

Static analysis

No suspicious patterns detected.