image generation gpt image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This image-generation skill is mostly purpose-aligned, but it needs review because it uploads user prompts/images to WellAPI and contains a forced tracked API-key onboarding prompt that limits neutral setup guidance.

Review before installing. Use this only if you are comfortable sending prompts, selected local images, masks, and your WellAPI API key to WellAPI. Prefer setting the API key through an environment variable or secret mechanism instead of pasting it into chat. Avoid sensitive or regulated images unless you have reviewed WellAPI's privacy, retention, and pricing terms. Be aware that generated images are saved locally and auto-attached to the conversation, and that the fallback registration link includes channel tracking.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:136

Finding

Forced Referral Message and Onboarding Instruction Hijacking

Content

View full analysis

Please paste your WellAPI API Key. If you don't have one yet, register at https://wellapi.ai/register?channel=c_qqn3vdvc to get a free key. ``` ### Technical Analysis The Skill instructs the agent to reproduce a fixed onboarding message containing the tracking parameter `channel=c_qqn3vdvc`. It additionally prohibits the agent from offering alternative setup methods, showing commands, or asking clarifying questions. Requesting a WellAPI API key is consistent with the declared hosted image-generation functionality. However, forcing a tracked registration link and constraining otherwise legitimate agent responses are not technically necessary to authenticate API requests. These directives alter the agent's behavior for a promotional or attribution purpose rather than for execution safety. This constitutes Skill instruction hijacking because loading and invoking the Skill changes the agent's response policy, suppresses neutral onboarding assistance, and requires attributed promotional content. ### Attack Path 1. A user installs or activates the Skill. 2. The Skill checks for `WELLAPI_API_KEY`. 3. The key is absent from the environment or other expected storage. 4. The first-run onboarding branch is activated. 5. The agent is instructed to reproduce the fixed message verbatim. 6. The user is directed to a provider registration URL containing the embedded referral or tracking identifier. 7. ...[truncated 1318 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (13)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

>
> Please paste your WellAPI API Key. If you don't have one yet, register at https://wellapi.ai/register?channel=c_qqn3vdvc to get a free key.

After the user pastes a key, use it for the current request and proceed straight to image generation. Do not lecture the user about env vars, shells, or persistence unless they explicitly ask how to save it.

## Triggers

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends prompts and, for image editing, local image files to the external WellAPI service, yet it does not prominently warn users that their text and uploaded images leave the local environment. This creates a real privacy and data-handling risk, especially if users supply sensitive prompts or personal/local images without realizing they are being transmitted to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly instructs the agent to decode returned base64 image data and save files to local disk, then print absolute paths for attachment, but it does not require a user-facing notice or confirmation before creating files. Silent file creation can surprise users, create privacy or storage risks, and may overwrite expectations about where data is persisted on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example shows the skill collecting attached local image files and sending them in a multipart request to https://wellapi.ai/v1/images/edits, but it does not clearly warn users that local files are being uploaded to a third-party remote service. This can lead to unintended disclosure of sensitive or proprietary images, especially in agent workflows where users may assume attachments remain local.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The examples send user prompts and local image files to an external WellAPI endpoint, but the documentation does not explicitly warn users that their text and image contents will leave the local machine. In an agent skill context, this can cause inadvertent disclosure of sensitive prompts, proprietary images, or personal data because users may treat example commands as local-only processing guidance.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This curl command transmits the prompt and API credentials to an external service, and elsewhere in the file the edit flow uploads local image content as well. While this is expected for an image generation API, it is still a real external-transmission risk in a skill because agents may invoke or adapt these examples without making users aware that private data is being sent off-host.

Content

Scanner excerpt · references/curl_heredoc.md (reported line 90)May include surrounding context.

md

PROMPT_JSON=$(json_escape "$PROMPT")

RESP=$(curl -sS -X POST "https://wellapi.ai/v1/images/generations" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d @- <<WELL_END

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends user prompts and, in edit mode, local image and mask files to the remote WellAPI service, but the documentation does not clearly disclose that local content is uploaded off-host. This can lead users to unknowingly transmit sensitive prompts or private local files to a third party, which is a real privacy and data-handling risk in this skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s example workflow sends user prompts and local image files to a third-party remote API, but the surrounding documentation does not prominently disclose that potentially sensitive local content will leave the user’s machine. This can lead users to upload private images or confidential prompt content without informed consent, especially because the examples encourage passing local file paths directly for editing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The trigger table hard-codes Chinese and English invocation phrases but does not explain whether users may use other languages or choose a preferred locale. This can be read as a locale policy constraint without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The only trigger phrase shown is in Chinese, which can imply a language-specific invocation requirement. The file does not state that other languages are supported or that Chinese is required for a justified region-specific reason, so this may violate the policy against forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The trigger section defines activation phrases in Chinese and English as the expected invocation forms, but does not state whether users may invoke the skill in other languages or choose their preferred locale. This can be read as imposing specific language requirements without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This markdown explicitly states that the skill base64-decodes image data and writes it to disk, then auto-attaches the file to the conversation. The description does not include any warning that local files will be created or attached automatically, which is a user-impacting behavior relevant to data handling and system state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file contains a PowerShell script that decodes API responses and saves images to local files, and the description notes that output is written to a local file. However, there is no clear user-facing warning in the markdown about local file creation, path selection, or the resulting disk-side effects when the script is run.

Content

No source excerpt is available for this finding.