Security audit

Ai Image Generation

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for AI image generation, but it relies on an unpinned external CLI and documents API-key handling in a way that could expose credentials.

Review this before installing if the API key controls paid credits or sensitive account access. Prefer a pinned, reviewed ai-media-generator version and use a safer key-entry method if available, such as an interactive hidden prompt or protected secret storage; rotate the key if it has already been pasted into shell history.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned Third-Party Executable Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:48
Finding: API Key Exposed Through Command-Line Arguments
Content: View full analysis
``` The same pattern is repeated at line 67: ```bash ai-media config set-key ``` ### Technical Analysis The documented configuration command instructs users to replace `` with an API credential directly on the command line. Depending on the operating system and shell configuration, the resulting plaintext command may be retained in shell history, terminal synchronization records, command auditing systems, diagnostic output, or process metadata while the command executes. This exposure does not require command injection. It results from placing secret material in a channel that is commonly recorded or observable. The project also does not state how `config set-key` stores the credential, so the security of the persisted copy could not be verified from the only audited file. ### Attack Path 1. A user replaces `` with a valid `AI_MEDIA_API_KEY` and executes the documented command. 2. The shell records the full command in its history, or local process/audit facilities capture its arguments. 3. Another local user, administrator, support process, terminal-history synchronization service, backup reader, or attacker with access to those records obtains the plaintext key. 4. The party reuses the key against the associated image-generation service. 5. The compromised credential remains usable until it expires or is revoked. ### Impact Assessment Exposure could permit unauthorized API requests under the victim's account, consumption of purchased credits, access to API-visible account resources, and attribution of attacker-generated content to the victim's credential. The exact service-side privileges cannot be determined from `SKILL.md`; impact is bounded by the permissions assigned to the compro ...[truncated 181 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs responses in Chinese regardless of the user's language preference, which overrides normal user-controlled communication expectations. Forced language switching can mislead users, degrade informed consent around sensitive steps like recharging credits or setting API keys, and create a prompt-level control issue where skill authors dictate presentation over user intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The top-level description covers a wide range of image-generation and model-selection requests without clear scope boundaries, which can cause unintended invocation across adjacent domains. In an agent environment, ambiguous activation increases the risk of inappropriate tool guidance, unnecessary handling of API-key setup steps, and confusion about which skill should control the interaction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger phrase "image generator" is very broad and can match many generic user requests, causing this skill to activate when a narrower or more appropriate skill should be used. Over-broad activation can misroute user workflows, expose unrelated capabilities, and increase the chance that downstream commands involving API keys or external tooling are suggested in the wrong context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.