Microsoft Foundry image generation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:20 PM UTC
• Version: 1.0.6

Overview

The skill is a coherent Azure image-generation helper, but its documented command can send a primary Azure API key to an arbitrary or plaintext endpoint.

Install only if you will set FOUNDRY_ENDPOINT yourself to a trusted HTTPS Azure Foundry/Cognitive Services endpoint and keep FOUNDRY_API_KEY narrowly scoped. Avoid using the sample unchanged on shared machines; replace the fixed /tmp paths with a private mktemp directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Azure API Key Disclosure Through an Untrusted or Plaintext Endpoint

Content

View full analysis

&2 exit 1 fi url="${FOUNDRY_ENDPOINT%/}/openai/deployments/${FOUNDRY_DEPLOYMENT}/images/generations?api-version=${FOUNDRY_API_VERSION:-2025-04-01-preview}" PROMPT="a red fox" jq -n --arg prompt "$PROMPT" '{prompt:$prompt, n:1, size:"1024x1024", output_format:"png"}' | \ curl --fail --show-error --silent \ --url "$url" \ -H 'Content-Type: application/json' \ -H "api-key: ${FOUNDRY_API_KEY}" \ ``` ### Technical Analysis The endpoint validation only verifies that the value resembles an HTTP or HTTPS URL with a syntactically simple hostname. It explicitly permits plaintext HTTP and does not restrict the hostname to an approved Azure Foundry service or another administrator-approved destination. The subsequent `curl` request sends the primary Azure credential in the `api-key` header. It also sends the image-generation prompt in the request body. Consequently, anyone able to influence `FOUNDRY_ENDPOINT` can direct both sensitive values to an arbitrary server that passes the weak regular expression. When HTTP is used, the API key and prompt are transmitted without TLS protection and can also be observed or modified by a network-positioned attacker. ### Attack Path 1. An attacker influences the environment or configuration used to set `FOUNDRY_ENDPOINT`. 2. The attacker sets it to a server under their control, such as `https://attacker.example`, or to a plaintext HTTP endpoint. 3. The value passes the regular expression because arbitrary hostnames and both URL schemes are accepted. 4. The skill constructs the image-generation URL bene ...[truncated 827 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:44

Finding

Predictable Temporary Files Allow Local Symlink File Overwrite

Content

View full analysis

/tmp/generated_image.png echo "Image saved to: /tmp/generated_image.png" ``` ### Technical Analysis The example uses fixed filenames in the globally shared `/tmp` directory. Neither file is securely created, and no check is made to determine whether either path is already a symbolic link. `curl -o` writes through the path supplied to it, while the shell output redirection for `/tmp/generated_image.png` opens and truncates the destination before writing. On systems where another local user can create entries in `/tmp`, an attacker can pre-create either predictable path as a symbolic link to another file writable by the user running the skill. This is a temporary-file symlink attack. Although `/tmp` commonly has the sticky bit enabled, that protection does not stop an attacker from creating a previously nonexistent predictable filename before the victim process uses it. ### Attack Path 1. A local attacker predicts that the skill will use `/tmp/generation_result.json` or `/tmp/generated_image.png`. 2. Before the skill runs, the attacker creates one of those paths as a symbolic link to a target file. 3. The victim invokes the documented command under an account that can write to the linked target. 4. `curl -o` or the shell redirection follows the symbolic link. 5. The target file is truncated and replaced with the generated JSON response or decoded image data. Successful exploitation requires local filesystem access and a target file writable by the account running the skill. A race condition is unnecessary if the attacker can create the predictable path before exe ...[truncated 530 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

PROMPT="a red fox"
jq -n --arg prompt "$PROMPT" '{prompt:$prompt, n:1, size:"1024x1024", output_format:"png"}' | \
  curl --fail --show-error --silent \
    --url "$url" \
    -H 'Content-Type: application/json' \
    -H "api-key: ${FOUNDRY_API_KEY}" \

Static analysis

No suspicious patterns detected.