Security audit

xAI Studio

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent xAI media-generation skill; it sends user-provided prompts and media to xAI and saves outputs locally, with privacy and dependency-pinning cautions but no evidence of hidden or malicious behavior.

Before installing, make sure you are comfortable sending prompts and any selected images or videos to xAI for processing, avoid using sensitive media unless that is acceptable for your use case, and consider pinning xai-sdk in a controlled environment to reduce dependency risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:22
Finding: Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
``` 2. Maintain a locked requirements file containing exact transitive dependency versions. 3. Record package hashes and install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review dependency updates before changing the lock file or accepted hashes. 5. Install dependencies only from an explicitly trusted index over TLS. 6. Perform installation and execution in an isolated virtual environment with only the filesystem and environment-variable access required by the Skill. 7. Update both `SKILL.md` and `README.md` so all documented installation paths use the same pinned, verified dependency set. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/run.py:513
Finding: Documented API Request Bounds Are Not Enforced
Content: View full analysis
Remediation: View remediation
int: number = int(value) if not minimum <= number <= maximum: raise argparse.ArgumentTypeError( f"value must be between {minimum} and {maximum}" ) return number return parse ``` 2. Apply it to the documented numeric limits: ```python gen.add_argument( "--count", type=bounded_int(1, 10), default=1, help="Number of images (default: 1, max: 10)", ) vgen.add_argument( "--duration", type=bounded_int(1, 15), default=5, help="Duration in seconds, 1-15 (default: 5)", ) ``` 3. Reject more than three `--image` arguments for image editing before reading or encoding files. 4. Establish and document safe maximum prompt counts for concurrent and multi-turn operations. 5. Validate timeout and polling values as positive and impose reasonable upper bounds. 6. Return a clear local validation error before creating the SDK client or initiating any remote request. 7. Consider displaying an operation-count or cost warning before unusually large multi-request workflows. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly encourages supplying local images and videos as well as remote URLs for editing and generation workflows, but it does not warn users that this content will be transmitted to xAI and that remote URL inputs may cause third-party fetching or exposure of sensitive media. In a media-processing skill, users may reasonably pass private photos, internal assets, or confidential videos; without a disclosure, they may unknowingly leak sensitive data to external services.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill clearly requires network access to the xAI API and reads local files provided as image inputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement by making its effective capabilities broader or less reviewable than the manifest suggests, which is especially relevant because it handles user-supplied local media and remote URLs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documentation describes image and video generation/editing but does not clearly warn that prompts, images, and videos are transmitted to the xAI API for external processing. Users may unknowingly send sensitive local media or confidential prompts to a third party, increasing the risk of privacy, compliance, and data-handling issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The helper functions automatically base64-encode local image and video files and send them to the remote xAI API with no explicit warning, confirmation, or privacy notice. This can cause unintentional exfiltration of sensitive local media if a user assumes processing is local or does not realize that file paths are uploaded off-host.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.