Masonry: generate images and video with models across providers

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:27 AM UTC
• Version: 1.1.6

Overview

This skill is a straightforward Masonry CLI helper for generating and downloading AI images or videos, with some normal but important credential and npm supply-chain cautions.

Install only if you are comfortable trusting the Masonry CLI package and giving it access to your Masonry account token. Prefer a pinned or reviewed CLI version where possible, avoid pasting tokens into chat, and enter credentials only in a local terminal or secure secret mechanism.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned npm Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-25
Vulnerability Type: Supply-chain exposure through an unpinned third-party dependency
Risk Level: Medium

Vulnerable code:

bash

npm install -g @masonryai/cli

bash

npx @masonryai/cli

Technical Analysis

The skill directs the agent to install or execute @masonryai/cli without specifying an exact version or verifying package integrity. Consequently, npm resolves the package version from the registry at execution time. The effective code can therefore differ from the package version that existed when this skill was audited.

Global installation also makes the resolved executable available outside the immediate skill invocation. The npx alternative can download and execute package code dynamically. npm package lifecycle scripts may run during installation, subject to the permissions of the account executing npm.

This finding does not establish that @masonryai/cli is malicious. It identifies a supply-chain trust boundary: compromise of the package, publisher account, registry resolution, or a future release could cause unreviewed code to execute.

Attack Path

1. An attacker compromises the package publisher, publishing pipeline, or another relevant supply-chain component.
2. A malicious version is published under the same package name or selected by npm's mutable default version resolution.
3. The agent follows the documented prerequisite and runs the unpinned npm install -g or npx command.
4. npm downloads the attacker-controlled version and may execute its lifecycle scripts.
5. The malicious package runs with the privileges and environment access of the invoking process.

Impact Assessment

Successful exploitation could execute arbitrary code as the user running the agent. That code could read files and environment variables accessible to that account, including MASONRY_TOKEN, alter user-writable files, ...[truncated 215 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a reviewed exact version, for example @masonryai/cli@X.Y.Z.
• Commit and enforce a lockfile when invoking the dependency through a local project installation.
• Verify the package artifact against an approved integrity hash or trusted internal registry.
• Prefer a locally installed, reviewed binary over dynamic npx execution.
• Disable lifecycle scripts where compatible, such as with npm install --ignore-scripts, and separately review any scripts that are genuinely required.
• Avoid global installation and run the package in a restricted environment with minimal filesystem, environment-variable, and network access.
• Establish a controlled dependency-update process that reviews new versions before deployment.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Authentication Token Passed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-37
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable code:

text

3. User opens the URL in a browser, authenticates, and copies the token.
4. Run: `masonry login --token <TOKEN>`

Technical Analysis

The authentication workflow instructs the agent to place the Masonry token directly in a command-line argument. Command-line arguments may be recorded in shell history, agent execution logs, terminal transcripts, telemetry, audit systems, or process-monitoring output. On systems with permissive process inspection, another local user or process may also be able to observe the argument while the command runs.

The document does not provide safeguards for suppressing history, redacting logs, securely deleting transcripts, or supplying the token through a protected input channel. Although the token placeholder is not itself a secret, replacing it as instructed with a real credential creates the exposure.

Attack Path

1. A user obtains a valid Masonry authentication token through the remote login flow.
2. The token is inserted into masonry login --token <TOKEN>.
3. The command or its arguments are retained in shell history, execution logs, telemetry, or process metadata.
4. An attacker with access to one of those records, or sufficient local process-inspection access during execution, retrieves the token.
5. The attacker presents the token to Masonry and operates with the authorization assigned to the associated account or workspace until the token expires or is revoked.

Impact Assessment

Exposure may permit unauthorized use of the victim's Masonry account or workspace within the token's granted scope. Potential consequences include viewing job information, generating content that consumes account quota, downloading generated media, or performing ot ...[truncated 209 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer a CLI login mode that reads the token from standard input without echoing it, such as an interactive hidden prompt.
• If supported, pass the credential through a protected file descriptor, operating-system credential store, or short-lived environment mechanism rather than a command-line argument.
• Ensure the CLI never prints the token and that execution infrastructure redacts authentication values from logs and telemetry.
• Warn users not to paste tokens into commands stored by shell history. If command-line use is unavoidable, document shell-specific history suppression and immediate history cleanup while noting that this does not address process inspection or external logging.
• Use short-lived, narrowly scoped tokens and provide clear revocation and rotation procedures.
• Restrict local access to credential files created by the CLI, using owner-only permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill recommends executing npx @masonryai/cli without a pinned version, which allows whatever package version is current at execution time to be fetched and run. In an agent or automation context, this creates supply-chain risk: a compromised upstream package, malicious publish, or breaking release could lead to unexpected code execution in the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The authentication flow instructs the user to copy a token and run masonry login --token <TOKEN> but does not warn that the token is a sensitive secret that must not be pasted into chat, logs, transcripts, or shared output. In an agent setting, users may disclose the token back to the assistant or include it in visible command history, enabling account compromise if exposed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.