Smart Image Finder

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:18 AM UTC
• Version: 1.0.4

Overview

This skill is a straightforward image search and download guide that uses external services and local file writes, with no hidden persistence or destructive behavior found.

Install only if you are comfortable with an agent making network requests to news sites, Brave Search, returned image hosts, and Pollinations, and writing downloaded images into the workspace. Avoid using sensitive search terms, protect the Brave API key, verify downloaded files before use, and review image licensing before publishing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a multi-method image discovery/generation tool, but the actual code chunk only implements a basic direct-download helper. It accepts a URL, saves the response to disk, checks file type, and reports success or failure. There is no logic for searching images, scraping news sites, interfacing with Brave, or generating images with AI. While downloading an image is related to part of the description, the primary advertised capabilities are materially broader than what this code actually does, so this is a clear description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a multi-function image discovery and generation tool, but the supplied code only validates an existing image file or URL. It checks HTTP status/content type for URLs and file metadata for local files. There is no implementation of searching, downloading, extracting from news sites, querying Brave, or generating images with AI. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes background image downloads and calls to third-party services without warning that user queries, article topics, and downloaded URLs are sent to external providers. In an agent setting, this can leak sensitive prompts, research topics, or internal context, and it also omits copyright/licensing considerations for downloaded images.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This example sends search queries and an API key to Brave, then downloads a returned image URL from another external host. In an agent workflow, that creates external data transmission and supply-chain risk: sensitive search topics may be disclosed, API credentials are used against a third party, and the returned URL may point to untrusted content despite being labeled as an image.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

export BRAVE_API_KEY="your_key"

Search and download in one line

IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship%202025&count=1"
-H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url') curl -sL -o spacex.jpg "$IMG_URL"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This is the Chinese duplicate of the Brave example and carries the same risk profile: query terms and credentials are transmitted externally, and the downloaded image URL may resolve to an untrusted remote source. In an autonomous agent context, silent outbound requests are more dangerous because they may happen without the user's awareness.

Content

Scanner excerpt · README.md (reported line 184)May include surrounding context.

export BRAVE_API_KEY="你的密钥"

一行命令搜索并下载

IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship%202025&count=1"
-H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url') curl -sL -o spacex.jpg "$IMG_URL"

text

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill clearly instructs shell-based network activity (curl, grep, file downloads) but does not declare any tool scope or permission boundaries. That increases the chance an agent can invoke shell/network behavior without transparent review, making unintended outbound requests and file writes more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad (find image, download picture, article illustration) and can match many ordinary requests, causing the skill to activate in situations where the user did not explicitly request shell-based downloads or external lookups. In an agent environment, overbroad activation raises the risk of unexpected network access, third-party API use, and file creation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill encourages downloading files and contacting external services in the background without a prominent warning or consent flow. That is risky because agents may transmit user queries to third parties, fetch untrusted content, and write files locally with little visibility to the user.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This command sends user-provided search terms and an API credential to Brave's external service. Even though external search is core to the skill, it still creates a real data-transmission risk because sensitive queries could be disclosed to a third party and the API key may be exposed through insecure handling or logging.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

export BRAVE_API_KEY="your_api_key"

# Search images
curl -s "https://api.search.brave.com/res/v1/images/search?q=keyword&count=10" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq '.results[] | {title, url: .properties.url, width: .properties.width}'

# Get first image URL directly

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

This example performs another outbound Brave API request and returns a direct image URL from an external source. That exposes the user's query to Brave and may lead to subsequent downloads from untrusted remote hosts, increasing supply-chain and content-safety risk.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

-H "X-Subscription-Token: $BRAVE_API_KEY" | jq '.results[] | {title, url: .properties.url, width: .properties.width}'

Get first image URL directly

curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20Starship&count=1"
-H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

Batch querying external search with user-controlled terms amplifies the data-sharing surface and can unintentionally automate bulk transmission of potentially sensitive topics. Because the loop directly interpolates $query into the URL, poorly encoded input can also cause malformed requests or unexpected parameter injection.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

bash

# Add delay between requests (1-2 seconds recommended)
for query in "query1" "query2" "query3"; do
  curl -s "https://api.search.brave.com/res/v1/images/search?q=$query&count=1" \
    -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url'
  sleep 2  # Wait 2 seconds between requests
done

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This workflow not only sends a query to Brave but immediately downloads the first returned URL without trust validation. Automatically fetching arbitrary third-party content can result in downloading malicious files, HTML error pages, oversized payloads, or deceptive content under an image filename, which is more dangerous than search alone.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

bash

# Search, get first result URL, download
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=SpaceX%20launch%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o spacex.jpg "$IMG_URL"
file spacex.jpg

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This end-to-end example combines external search with immediate download of the returned URL, creating the same unsafe direct-fetch behavior in a realistic workflow. In context, the skill is designed for automated background use, which makes silent retrieval of untrusted remote files more dangerous because users may not realize where content originated or what was fetched.

Content

Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.

md

curl -sL -o starmer-xi.jpg "${IMG_URL}?width=3000&quality=100"

# Option B: Brave search (no browser)
IMG_URL=$(curl -s "https://api.search.brave.com/res/v1/images/search?q=Keir%20Starmer%20Xi%20Jinping%202025&count=1" \
  -H "X-Subscription-Token: $BRAVE_API_KEY" | jq -r '.results[0].properties.url')
curl -sL -o starmer-xi.jpg "$IMG_URL"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The document explicitly presents only English and Chinese sections, with no indication that the skill can adapt to the user's preferred language or that this bilingual restriction is required by the skill's domain. Under the language/locale policy, forcing specific languages without user opt-in can be a policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The table states fixed prompt languages such as "Pollinations | English," "Jimeng | Chinese," and "DALL-E | English," which can be read as a language/locale constraint without user opt-in. The document does not explain that language selection is optional or dependent on platform capabilities.

Content

No source excerpt is available for this finding.