Security audit

Visnote Image Creator

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it handles the VisNote API key in ways users should review before installing.

Install only if you trust VisNote with your image-generation content and API key. Do not let the agent print config.json, avoid using --server unless it is a domain you explicitly trust, and consider rotating the API key if it has appeared in logs, browser history, or shared transcripts.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs creating or overwriting config.json with an API key, which expands the skill from image generation into credential handling and filesystem modification. This is dangerous because an agent following the instructions may write sensitive secrets to disk, overwrite existing configuration, or mishandle credentials without explicit user consent or secure storage controls.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script accepts an arbitrary --server value and then uses it both for the API key validation request and to build the editor URL, causing the configured bearer token to be sent to any attacker-controlled endpoint. This enables credential exfiltration and potentially exposure of user-supplied data to untrusted infrastructure, which is especially risky in an agent skill that may construct and invoke commands automatically.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill tells the agent to read config.json and inspect whether an apikey is set, but provides no warning that this is sensitive credential material. Even if the intent is only validation, instructing an agent to cat the file increases the chance of exposing the API key in logs, model context, or user-visible output.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill requires external requests to VisNote APIs as part of normal operation but does not clearly warn that user prompts, keywords, template selections, and possibly generated content may be transmitted to a third-party service. This creates a privacy and data-governance risk, especially if users provide proprietary, personal, or regulated content for image generation.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The API key is embedded directly into the editor URL query string, which is commonly exposed through browser history, logs, analytics, reverse proxies, crash reports, and Referer leakage. Because the script launches a browser to a remote page, the credential may be accessible to the remote application and any intermediate logging layers beyond the intended authentication path.

Static analysis

No suspicious patterns detected.