Smart Image Finder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.0.4

Overview

This skill is a straightforward image search and download guide that uses external services and local file writes, with no hidden persistence or destructive behavior found.

Install only if you are comfortable with an agent making network requests to news sites, Brave Search, returned image hosts, and Pollinations, and writing downloaded images into the workspace. Avoid using sensitive search terms, protect the Brave API key, verify downloaded files before use, and review image licensing before publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a multi-method image discovery/generation tool, but the actual code chunk only implements a basic direct-download helper. It accepts a URL, saves the response to disk, checks file type, and reports success or failure. There is no logic for searching images, scraping news sites, interfacing with Brave, or generating images with AI. While downloading an image is related to part of the description, the primary advertised capabilities are materially broader than what this code actually does, so this is a clear description-to-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a multi-function image discovery and generation tool, but the supplied code only validates an existing image file or URL. It checks HTTP status/content type for URLs and file metadata for local files. There is no implementation of searching, downloading, extracting from news sites, querying Brave, or generating images with AI. This is a materially different primary purpose, so the description does not accurately represent the code.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes background image downloads and calls to third-party services without warning that user queries, article topics, and downloaded URLs are sent to external providers. In an agent setting, this can leak sensitive prompts, research topics, or internal context, and it also omits copyright/licensing considerations for downloaded images.

External Transmission

Medium

• Category: Data Exfiltration

Content

export BRAVE_API_KEY="your_key"

# Search and download in one line
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o spacex.jpg "$IMG_URL"
```

• Confidence: 93% confidence
• Finding: This example sends search queries and an API key to Brave, then downloads a returned image URL from another external host. In an agent workflow, that creates external data transmission and supply-chain risk: sensitive search topics may be disclosed, API credentials are used against a third party, and the returned URL may point to untrusted content despite being labeled as an image.

External Transmission

Medium

• Category: Data Exfiltration

Content

export BRAVE_API_KEY="你的密钥"

# 一行命令搜索并下载
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o spacex.jpg "$IMG_URL"
```

• Confidence: 93% confidence
• Finding: This is the Chinese duplicate of the Brave example and carries the same risk profile: query terms and credentials are transmitted externally, and the downloaded image URL may resolve to an untrusted remote source. In an autonomous agent context, silent outbound requests are more dangerous because they may happen without the user's awareness.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs shell-based network activity (`curl`, `grep`, file downloads) but does not declare any tool scope or permission boundaries. That increases the chance an agent can invoke shell/network behavior without transparent review, making unintended outbound requests and file writes more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad (`find image`, `download picture`, `article illustration`) and can match many ordinary requests, causing the skill to activate in situations where the user did not explicitly request shell-based downloads or external lookups. In an agent environment, overbroad activation raises the risk of unexpected network access, third-party API use, and file creation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill encourages downloading files and contacting external services in the background without a prominent warning or consent flow. That is risky because agents may transmit user queries to third parties, fetch untrusted content, and write files locally with little visibility to the user.

External Transmission

Medium

• Category: Data Exfiltration

Content

export BRAVE_API_KEY="your_api_key"

# Search images
curl -s "https://api.search.brave.com/res/v1/images/search?q=keyword&count=10" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq '.results[] | {title, url: .properties.url, width: .properties.width}'

# Get first image URL directly

• Confidence: 95% confidence
• Finding: This command sends user-provided search terms and an API credential to Brave's external service. Even though external search is core to the skill, it still creates a real data-transmission risk because sensitive queries could be disclosed to a third party and the API key may be exposed through insecure handling or logging.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "X-Subscription-Token: $BRAVE_API_KEY" | jq '.results[] | {title, url: .properties.url, width: .properties.width}'

# Get first image URL directly
curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url'
```

• Confidence: 95% confidence
• Finding: This example performs another outbound Brave API request and returns a direct image URL from an external source. That exposes the user's query to Brave and may lead to subsequent downloads from untrusted remote hosts, increasing supply-chain and content-safety risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Add delay between requests (1-2 seconds recommended)
for query in "query1" "query2" "query3"; do
  curl -s "https://api.search.brave.com/res/v1/images/search?q=$query&count=1" \
    -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url'
  sleep 2  # Wait 2 seconds between requests
done

• Confidence: 95% confidence
• Finding: Batch querying external search with user-controlled terms amplifies the data-sharing surface and can unintentionally automate bulk transmission of potentially sensitive topics. Because the loop directly interpolates `$query` into the URL, poorly encoded input can also cause malformed requests or unexpected parameter injection.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search, get first result URL, download
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20launch%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o spacex.jpg "$IMG_URL"
file spacex.jpg

• Confidence: 97% confidence
• Finding: This workflow not only sends a query to Brave but immediately downloads the first returned URL without trust validation. Automatically fetching arbitrary third-party content can result in downloading malicious files, HTML error pages, oversized payloads, or deceptive content under an image filename, which is more dangerous than search alone.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -sL -o starmer-xi.jpg "${IMG_URL}?width=3000&quality=100"

# Option B: Brave search (no browser)
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=Keir%20Starmer%20Xi%20Jinping%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o starmer-xi.jpg "$IMG_URL"

• Confidence: 97% confidence
• Finding: This end-to-end example combines external search with immediate download of the returned URL, creating the same unsafe direct-fetch behavior in a realistic workflow. In context, the skill is designed for automated background use, which makes silent retrieval of untrusted remote files more dangerous because users may not realize where content originated or what was fetched.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The document explicitly presents only English and Chinese sections, with no indication that the skill can adapt to the user's preferred language or that this bilingual restriction is required by the skill's domain. Under the language/locale policy, forcing specific languages without user opt-in can be a policy violation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The table states fixed prompt languages such as "Pollinations | English," "Jimeng | Chinese," and "DALL-E | English," which can be read as a language/locale constraint without user opt-in. The document does not explain that language selection is optional or dependent on platform capabilities.

Static analysis

No suspicious patterns detected.