xAI Studio

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:51 AM UTC
• Version: 0.2.2

Overview

This is a coherent xAI media-generation skill; it sends user-provided prompts and media to xAI and saves outputs locally, with privacy and dependency-pinning cautions but no evidence of hidden or malicious behavior.

Before installing, make sure you are comfortable sending prompts and any selected images or videos to xAI for processing, avoid using sensitive media unless that is acceptable for your use case, and consider pinning xai-sdk in a controlled environment to reduce dependency risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22
• Finding: Unpinned Third-Party SDK Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:22-27`, `SKILL.md:41`, `README.md:31` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Evidence ```yaml install: - id: xai-sdk kind: pip3 package: xai-sdk label: "Install official xAI SDK" ``` ```bash pip3 install xai-sdk ``` The README provides the same unpinned installation instruction: ```bash venv/bin/pip3 install xai-sdk ``` ### Technical Analysis The Skill installs `xai-sdk` without specifying an exact version or package integrity hash. Consequently, the effective dependency code can change after this Skill has been audited. Python package installation can execute package-controlled build and installation logic, while the installed SDK subsequently operates inside the Skill process. Although the package is described as the official xAI SDK and no evidence shows that its current release is malicious, the installation is not reproducible or cryptographically constrained. A compromised package publisher account, malicious future release, package-index compromise, or unexpected upstream change could introduce code not present during this audit. ### Attack Path 1. An attacker compromises the upstream package, its publication account, or the package distribution channel. 2. The attacker publishes a modified release under the expected `xai-sdk` package name. 3. A user installs or reinstalls the Skill using the unpinned dependency declaration or documented `pip3 install xai-sdk` command. 4. Pip retrieves and installs the changed release. 5. Package installation logic or imported SDK code executes with the privileges of the user running the Skill. 6. The compromised dependency can access process environment variables, including `XAI_API_KEY`, read user-accessible files, alter generated output, or initiate arbitrary network requests. ### Impact Assessment Successful exploitation would provide code execution with the operating-system privileges ...[truncated 365 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the SDK to a reviewed exact version, for example: ```yaml package: xai-sdk==<reviewed-version> ``` 2. Maintain a locked requirements file containing exact transitive dependency versions. 3. Record package hashes and install with hash verification: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Review dependency updates before changing the lock file or accepted hashes. 5. Install dependencies only from an explicitly trusted index over TLS. 6. Perform installation and execution in an isolated virtual environment with only the filesystem and environment-variable access required by the Skill. 7. Update both `SKILL.md` and `README.md` so all documented installation paths use the same pinned, verified dependency set. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/run.py:513
• Finding: Documented API Request Bounds Are Not Enforced<![CDATA[ ## Vulnerability Details **File Location**: `scripts/run.py:513-516`, `scripts/run.py:599-602`; affected API calls at `scripts/run.py:242-249` and `scripts/run.py:394-410` **Vulnerability Type**: Missing numeric input validation for billable remote operations **Risk Level**: Low ### Evidence The image count argument claims a maximum of 10 but defines no validation constraint: ```python gen.add_argument( "--count", type=int, default=1, help="Number of images (default: 1, max: 10)" ) ``` The unvalidated value is passed to the batch API: ```python count = args.count print( f"Generating {count} image(s) — model={args.model}, ratio={args.aspect_ratio}" ) if count == 1: response = client.image.sample(**kwargs) _save_response(response, _make_stem("generate", 1), out_dir) else: responses = client.image.sample_batch(**kwargs, n=count) for i, resp in enumerate(responses, 1): _save_response(resp, _make_stem("generate", i), out_dir) ``` The video duration argument similarly claims a range of 1–15 seconds but does not enforce it: ```python vgen.add_argument( "--duration", type=int, default=5, help="Duration in seconds, 1-15 (default: 5)" ) ``` The unvalidated duration is forwarded to the remote API: ```python kwargs = _build_common_video_kwargs( args, {"prompt": args.prompt, "duration": args.duration} ) # Image-to-video when a source image is provided if args.image: kwargs["image_url"] = _encode_image(args.image) print( f"Generating video from image — model={args.model}, duration={args.duration}s" ) else: print(f"Generating video — model={args.model}, duration={args.duration}s") response = client.video.generate(**kwargs) ``` ### Technical Analysis Argparse verifies only that these values are integers. It accepts zero, negative values, and arbitrarily large positive values despite the limits stated in the help text and documentation. The values control remote, potentially billable xAI ope ...[truncated 1966 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define an argparse range validator: ```python def bounded_int(minimum: int, maximum: int): def parse(value: str) -> int: number = int(value) if not minimum <= number <= maximum: raise argparse.ArgumentTypeError( f"value must be between {minimum} and {maximum}" ) return number return parse ``` 2. Apply it to the documented numeric limits: ```python gen.add_argument( "--count", type=bounded_int(1, 10), default=1, help="Number of images (default: 1, max: 10)", ) vgen.add_argument( "--duration", type=bounded_int(1, 15), default=5, help="Duration in seconds, 1-15 (default: 5)", ) ``` 3. Reject more than three `--image` arguments for image editing before reading or encoding files. 4. Establish and document safe maximum prompt counts for concurrent and multi-turn operations. 5. Validate timeout and polling values as positive and impose reasonable upper bounds. 6. Return a clear local validation error before creating the SDK client or initiating any remote request. 7. Consider displaying an operation-count or cost warning before unusually large multi-request workflows. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README explicitly encourages supplying local images and videos as well as remote URLs for editing and generation workflows, but it does not warn users that this content will be transmitted to xAI and that remote URL inputs may cause third-party fetching or exposure of sensitive media. In a media-processing skill, users may reasonably pass private photos, internal assets, or confidential videos; without a disclosure, they may unknowingly leak sensitive data to external services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly requires network access to the xAI API and reads local files provided as image inputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement by making its effective capabilities broader or less reviewable than the manifest suggests, which is especially relevant because it handles user-supplied local media and remote URLs.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill documentation describes image and video generation/editing but does not clearly warn that prompts, images, and videos are transmitted to the xAI API for external processing. Users may unknowingly send sensitive local media or confidential prompts to a third party, increasing the risk of privacy, compliance, and data-handling issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The helper functions automatically base64-encode local image and video files and send them to the remote xAI API with no explicit warning, confirmation, or privacy notice. This can cause unintentional exfiltration of sensitive local media if a user assumes processing is local or does not realize that file paths are uploaded off-host.

Static analysis

No suspicious patterns detected.