T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/image-edit.sh:85- Finding
Undisclosed Upload of Local Images to a Third-Party Temporary Hosting Service
- Content
View full analysis
- Remediation
View remediation
Security audit
Pollinations
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it says, but it has under-disclosed local-file upload behavior and a URL-handling flaw that could disclose local files.
Review before installing. Use this skill only with prompts and media you are comfortable sending to external AI services. Avoid local image editing unless you accept upload through a temporary public host, and do not let untrusted instructions choose transcription inputs because file:// style inputs could expose readable local files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/transcribe.sh:55- Finding
Arbitrary URI Scheme Handling Enables Local File Disclosure
- Content
View full analysis
"$B64_FILE" else # URL: download first echo "Downloading audio..." TEMP_AUDIO=$(mktemp /tmp/audio_dl_XXXXXX) trap "rm -f '$BODY_FILE' '$B64_FILE' '$TEMP_AUDIO'" EXIT curl -s -o "$TEMP_AUDIO" "$AUDIO_INPUT" FORMAT=$(detect_format "$AUDIO_INPUT") base64 -w0 "$TEMP_AUDIO" > "$B64_FILE" fi ``` The downloaded data is subsequently transmitted to Pollinations: ```bash RESPONSE=$(curl -s --max-time 300 -H "Content-Type: application/json" \ ${POLLINATIONS_API_KEY:+-H "Authorization: Bearer $POLLINATIONS_API_KEY"} \ -X POST "https://gen.pollinations.ai/v1/chat/completions" \ -d @"$BODY_FILE") ``` ## Technical Analysis Any input that is not recognized by `[[ -f "$AUDIO_INPUT" ]]` is treated as a remote URL and passed directly to `curl`. No URL parser or protocol allowlist restricts the accepted scheme. By default, curl supports schemes other than HTTP and HTTPS, including `file://`. A value such as `file:///etc/passwd` is not recognized by Bash as a regular path because it contains the URI prefix, but curl can resolve it as a local file. The retrieved bytes are written to a temporary file, Base64-encoded, embedded in the request body, and transmitted to Pollinations. The code also lacks meaningful validation that downloaded content is audio. Format detection is based only on the supplied string's extension and defaults to MP3, so arbitrary process-readable content can be labeled as audio and sent externally. ### Attack Path 1. An attacker influences the argument passed to `scripts/transcribe.sh`, such as through an untrusted agent instruction or an application that exposes the script arguments. 2. The attacker supplies a ...[truncated 1229 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (42)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code implements only a text chat/completions client for the Pollinations API. It constructs a messages array, posts to the chat completions endpoint, and extracts textual response content. There is no evidence in this chunk of image, video, audio, vision-analysis, or transcription functionality. While using Pollinations.ai is accurately represented, the declared description materially overstates the implemented capabilities of this specific code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description describes a comprehensive Pollinations.ai skill covering text, images, videos, audio, analysis, and transcription via OpenAI-compatible endpoints. The supplied code chunk is much narrower: it only handles media generation by constructing a GET request to the Pollinations image endpoint and saving the returned file locally. It may incidentally support video output for certain models and includes an audio query flag, but there is no implementation for text generation, analysis, transcription, or general API coverage. Therefore the description materially overstates the skill's actual behavior for this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a full-featured Pollinations.ai integration for generation and analysis tasks across multiple modalities. In contrast, this code chunk is a utility script whose sole function is to fetch and print model identifiers from Pollinations endpoints, with some hardcoded fallback model names. It does not call generation, analysis, or transcription endpoints, accept user content, or perform any AI task itself. While model listing is related to the Pollinations ecosystem, it is a materially narrower and different purpose than the declared end-user capabilities.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill allows selecting named external models such as Claude through a third-party integration, but does not explain routing, trust boundaries, or whether prompts may be forwarded to additional providers. In this context, external model selection can expose user data to different vendors with different handling policies, which is a real privacy and governance risk.
- Content
Usage:
bash scripts/chat.sh "your message" scripts/chat.sh "your message" --model claude --temp 0.7 scripts/chat.sh "explain quantum physics" --model openai --max-tokens 500 scripts/chat.sh "list 3 colors" --json --model openai scripts/chat.sh "solve this step by step" --model o3 --reasoning-effort high
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The Gemini example reinforces that prompts can be routed to alternate external providers without explicit trust or privacy disclosures. Because the skill is broadly activatable, users may not realize their content is leaving the primary environment and being processed by a different vendor.
- Content
scripts/chat.sh "explain quantum physics" --model openai --max-tokens 500 scripts/chat.sh "list 3 colors" --json --model openai scripts/chat.sh "solve this step by step" --model o3 --reasoning-effort high scripts/chat.sh "translate to French" --system "You are a translator" --model gemini
text **Options:**
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 2. Image Generation (`scripts/image.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 3. Image Editing / Image-to-Image (`scripts/image-edit.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 3. Image Editing / Image-to-Image (`scripts/image-edit.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 3. Image Editing / Image-to-Image (`scripts/image-edit.sh`)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ### 3. Image Editing / Image-to-Image (`scripts/image-edit.sh`)
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
This example combines external provider selection with image analysis of local files, which can transmit sensitive visual data to a third-party model provider such as Claude. The context makes this more dangerous than ordinary text prompting because images may contain IDs, documents, faces, screens, or other high-sensitivity content.
- Content
bash scripts/analyze-image.sh "https://example.com/photo.jpg" scripts/analyze-image.sh photo.jpg --prompt "What objects are in this image?" scripts/analyze-image.sh image.png --model claude --prompt "Extract all text from this image"Options:
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill documents sending video content to a selected external model, which may reveal sensitive scenes, people, locations, or business activity to third-party providers. Video often contains more contextual and biometric data than text, so provider-routing ambiguity significantly increases privacy risk.
- Content
bash scripts/analyze-video.sh "https://example.com/video.mp4" scripts/analyze-video.sh recording.mp4 --prompt "Summarize the key moments" scripts/analyze-video.sh clip.mov --model gemini-large --prompt "Count the people"Options:
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
Audio transcription with a selectable external model can expose voiceprints, conversations, and confidential meetings to a third-party provider. In this skill, the risk is elevated because the documentation encourages use with local files but does not pair that with strong data-transfer warnings or provider transparency.
- Content
Usage:
bash scripts/transcribe.sh recording.mp3 scripts/transcribe.sh podcast.wav --model gemini-large scripts/transcribe.sh "https://example.com/audio.mp3" --prompt "Transcribe in French"
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
When the user provides a local file, the script silently uploads that file to litterbox.catbox.moe, an unrelated third-party host, making the image accessible outside the user's local environment. This is a clear data exfiltration/privacy risk because users may pass sensitive screenshots, identity documents, or internal images, and the skill context encourages routine AI image editing where such content is plausible.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill documents shell-based scripts and package installation steps but does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization ambiguity where an agent may invoke shell capabilities more broadly than reviewers or users expect, increasing the chance of unintended command execution.
- Content