Imagine

• Outcome: Review
• Latest audit: Sep 23, 2026 · 2:58 AM UTC
• Version: 1.0.0

Overview

This is mostly an image art-direction skill, but it also ships a silent self-update path that can pull from GitHub and discard local repository changes without clear user consent.

Review carefully before installing. The art-direction features are understandable, but do not allow or invoke the update path unless you are comfortable with silent GitHub pulls and possible loss of local changes; consider removing or disabling the updater and avoid putting sensitive prompts or private image references into this skill's journals.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update.sh:12

Finding

Unconfirmed Destructive Repository Cleanup During Self-Update

Content

View full analysis

Vulnerability Details

File Location: scripts/update.sh, lines 12–15
Vulnerability Type: Destructive update operation without confirmation or dry-run protection
Risk Level: Medium

Complete Code Snippet

bash

cd "$(dirname "$0")/.."
git reset --hard HEAD 2>/dev/null
git clean -fd 2>/dev/null
git pull 2>/dev/null

Technical Analysis

The self-update script changes into the Skill repository and unconditionally performs two destructive Git operations before pulling updates:

• git reset --hard HEAD discards modifications to tracked files in the index and working tree.
• git clean -fd recursively deletes untracked files and directories.

The script provides no confirmation prompt, explicit destructive-operation flag, dry-run mode, or backup mechanism. Redirecting standard error to /dev/null further obscures failures and makes it harder for the operator to understand which update step failed.

This behavior conflicts with the preservation-oriented update procedure documented in references/self-update-imagine.md:5, which specifies:

text

cd {agent_root}/skills/ocas-imagine && git stash && git pull origin main && git stash pop

The executable implementation therefore expands a routine update operation into an irreversible local cleanup that is not disclosed by its usage message, which only states that it pulls the latest version while preserving local data.

Attack Path

1. The update helper is invoked directly with bash scripts/update.sh, or through the self-update mechanism described by the Skill.
2. The script changes into the repository root.
3. git reset --hard HEAD silently removes tracked local modifications.
4. git clean -fd silently removes all untracked files and directories beneath that repository.
5. Only after this deletion does the script run git pull.
6. Any local customization or untracked data stored in the Skill repository is lost without an interactive approval step or recoverable backup.

No ...[truncated 922 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the unconditional git reset --hard and git clean -fd operations from the normal update path.
2. Implement the documented preservation flow using git stash, an explicit upstream pull, and git stash pop, while handling merge conflicts safely.
3. If cleanup is genuinely required, place it behind an explicit option such as --discard-local-changes.
4. Before destructive cleanup:
   • Show the affected tracked and untracked files.
   • Require explicit user confirmation.
   • Support a dry-run mode.
   • Create a recoverable backup or archive.
5. Validate that the resolved repository directory is the intended Skill root before running Git commands.
6. Stop suppressing all Git errors. Return clear failures and abort immediately when a step fails.
7. Update the usage text and Skill documentation so the actual effects are accurately disclosed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for an image-generation/style-consistency skill, but the supplied code does not generate, render, analyze, or manage image styles. Its sole function is repository maintenance: it changes to the project root, runs 'git reset --hard HEAD', 'git clean -fd', and 'git pull'. This is a materially different primary purpose and involves filesystem modification and network access to GitHub that are not reflected in the description. Therefore, this is a clear mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The file states that a universal self-update cron exists, which implies the skill or its environment may modify itself outside direct user invocation. Even without implementation details here, unattended update mechanisms introduce a supply-chain and integrity risk because remote changes could alter behavior, prompts, or file contents without per-run review.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

## Background Tasks

Imagine has no operational background tasks. The universal `imagine:update` self-update cron is standard and is not enumerated here.

## Self-Update

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The dedicated 'Self-Update' section confirms that self-modification is part of the skill's documented lifecycle. In agent contexts, self-updating behavior is dangerous because it can change trusted instructions and capabilities after review, weakening the assurance provided by static analysis of the current file.

Content

Scanner excerpt · SKILL.md (reported line 190)May include surrounding context.

md

Imagine has no operational background tasks. The universal `imagine:update` self-update cron is standard and is not enumerated here.

## Self-Update

See `references/self-update-imagine.md`.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Referencing an external self-update document indicates that important modifying behavior is defined out-of-band, reducing transparency and making review incomplete. Hidden or externally specified mutation paths are risky because they can introduce new code or instructions beyond what this file discloses.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

## Self-Update

See `references/self-update-imagine.md`.

## Visibility

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/api_reference.md (reported line 38)May include surrounding context.

resize to exact target with PIL LANCZOS (GenTube's "16:9" renders 1344×768 — always resize). 7. Verify: PIL opens the file, 1600×900, white-bright pixel fraction < 1% (text-leak check).

Use natural-language image output instructions, not a tool call:

text

Use the current active text-to-image model to generate an image.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

A GitHub update capability is not justified by the skill's declared art-direction purpose and effectively introduces a supply-chain or remote code/content update path into a user-invokable interface. If triggered, it could pull unreviewed changes, alter behavior, or introduce malicious content/code, making the skill materially more dangerous than its advertised functionality suggests.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

A self-update/self-modification procedure in a skill is inherently risky because it gives the skill a pathway to change its own behavior after deployment. In the context of an image-generation skill, this behavior is especially out of scope and therefore more suspicious and dangerous, since no functional need justifies repository mutation.

Content

Scanner excerpt · references/self-update-imagine.md (reported line 1)May include surrounding context.

md

# Imagine — Self-Update Procedure

`imagine.update` pulls the latest package from GitHub. Runs silently.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill documents a self-update capability that modifies its own codebase despite being scoped as an image-generation skill. This creates an unnecessary supply-chain and integrity risk: a prompt-invoked art skill should not be able to fetch and alter local files, and doing so silently removes an important user control point.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documented git stash && git pull origin main && git stash pop flow performs direct code retrieval and self-modification from a remote repository, which is unjustified for an image-generation skill. This exposes the environment to remote code changes, branch hijacking, accidental merge conflicts, and unreviewed updates that could alter future behavior or introduce malicious code.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

A self-update mechanism modifies the local codebase by pulling fresh content from GitHub, which creates a software supply-chain risk if the remote repository, branch, or transport trust is compromised. In an agent skill context, self-modification is more dangerous because future behavior can change outside the originally reviewed package.

Content

Scanner excerpt · scripts/update.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# update.sh — Self-update ocas-imagine from GitHub
# Usage: bash update.sh [--help]
# --help: Show this help message

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The updater invokes a powerful destructive tool parameter, git reset --hard, which forcibly resets tracked files regardless of user state. In combination with self-update behavior, this enables silent overwriting of local code and loss of changes, making the skill more dangerous than its art-generation context suggests.

Content

Scanner excerpt · scripts/update.sh (reported line 13)May include surrounding context.

sh

fi

cd "$(dirname "$0")/.."
git reset --hard HEAD 2>/dev/null
git clean -fd 2>/dev/null
git pull 2>/dev/null

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase "Tell it what you need. It does the work." is extremely broad and does not define what kinds of requests should activate this skill versus ordinary conversation. In a markdown skill description, this kind of vague trigger language can cause unintended invocation because it lacks scope, constraints, or negative examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases like 'generate image', 'ai art', and especially 'illustrate' are broad and likely to match ordinary user requests outside the intended narrow workflow. Over-broad activation can cause accidental routing, unnecessary access to user content, and unintended execution of logging and persistence behaviors for conversations that did not meaningfully consent to using this skill.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly stores user intents and generation outputs in persistent journals, creating a durable record of natural-language user content. If prompts contain sensitive personal, proprietary, or regulated information, this retention expands exposure and may violate least-data-retention principles.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Requiring every action journal to persist the final synthesized prompt and image URL ensures that user-supplied scene descriptions are copied into long-lived records. This can leak sensitive user requests into files that may later be accessed by operators, other tools, backups, or incidentally exposed storage.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Append-only logs for intents and generation history create long-term accumulation of user-provided content with no deletion path apparent in this file. Persistent append-only storage increases blast radius in the event of compromise and can turn innocuous creative requests into a privacy liability over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The interactive menu exposes maintenance actions ('journal' and especially 'update' from GitHub) that are outside the stated art-direction/image-generation scope of the skill. Mixing operational controls into a user-facing creative skill increases the chance that a normal user invocation can trigger privileged or risky behavior, expanding the attack surface and enabling misuse through prompting or accidental selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The journal schema explicitly stores content prompts, image references, and generated outputs, which can include sensitive user data, proprietary prompts, local file paths, or external URLs. In an image-generation skill, this creates a real privacy and data-retention risk if users are not informed, if retention is broader than necessary, or if logs are accessible to other components or operators.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The procedure explicitly says it 'Runs silently' while performing a git-based update of local files. Silent modification of the local skill directory prevents informed consent and makes it harder for users or operators to detect configuration drift, failures, or malicious tampering.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script's help text states that local data will be preserved, but it immediately runs git reset --hard and git clean -fd, which discard modified tracked files and remove untracked files/directories. This is a real integrity and data-loss issue because users may rely on the misleading claim and lose work when invoking the updater.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

git reset --hard and git clean -fd are destructive commands that irreversibly discard local modifications and untracked content, yet the script provides no warning or confirmation. In practice, this can cause accidental loss of prompts, assets, configuration, or other repository-local work if a user runs the updater.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON manifest-like eval file includes example inputs such as "Create a series of images" and "Capture the style from a reference image" that are generic natural-language requests and could overlap with ordinary user speech. The file provides no explicit trigger boundaries, exclusion conditions, or narrow activation context to clarify when the skill should or should not be invoked.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill is described as an art-generation tool, but it also contains repository self-update behavior that is not disclosed in the main skill description. Hidden or undocumented update capabilities increase supply-chain and trust risk because users may not expect the skill to modify its own codebase from a remote source.

Content

No source excerpt is available for this finding.