Don't download

• Outcome: Review
• Latest audit: May 28, 2026 · 2:00 AM UTC
• Version: 1.0.0

Overview

This Bria image skill mostly matches its stated purpose, but it needs Review because it handles and persists reusable Bria credentials while using broad activation guidance for remote image processing.

Install only if you intend to let the agent use your Bria account for image generation or editing. Use a dedicated revocable Bria API key, avoid private or regulated images unless you accept Bria's handling terms, and review or remove ~/.bria/credentials if you do not want tokens reused across sessions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill clearly instructs the agent to execute shell commands and use curl, yet it does not declare corresponding permissions. This creates a capability/permission mismatch that can bypass user expectations and platform policy enforcement, especially because the shell is then used for authentication, file writes, and network access.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description says to use this skill for essentially any request involving images or visual content creation, which is far broader than necessary. Overbroad activation can cause the agent to invoke external APIs and credential-handling flows for generic image discussions, increasing unintended data exposure and tool misuse risk.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The usage section includes a catch-all rule to use the skill whenever the user mentions images, photos, visuals, or any visual content creation. In an agent setting, this can over-trigger the skill in benign conversational contexts and route user content to a third-party service without sufficiently specific consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs callers to transmit API credentials and user-supplied image data to a third-party service but does not include any warning about privacy, retention, or data disclosure. In an image-processing skill, users may submit sensitive photos or proprietary assets, so omission of clear disclosure and consent guidance creates a real privacy and trust risk even if the transport is HTTPS.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes request payloads and API responses to predictable files in /tmp, which can expose sensitive image content, prompts, and returned URLs to other local users or processes on shared systems. Because the files are not created with a securely randomized name or restrictive permissions, this creates a local data exposure risk beyond normal API usage.

External Transmission

Medium

• Category: Data Exfiltration

Content

**2a. Request a device code:**

```bash
DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \
  -H "Content-Type: application/json")
echo "$DEVICE_RESPONSE"
```

• Confidence: 92% confidence
• Finding: This step sends authentication-related data to an external service and prints the full device authorization response, which contains the device_code used for token polling. Even if intended for normal login, exposing and transmitting auth material through shell output increases the chance of token interception through logs, agent transcripts, or other local observers.

External Transmission

Medium

• Category: Data Exfiltration

Content

Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:

```bash
INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
  -d "token=$BRIA_ACCESS_TOKEN")
BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p')
if [ "$BILLING_STATUS" = "blocked" ]; then

• Confidence: 88% confidence
• Finding: The token introspection step transmits the bearer token to a remote endpoint and retrieves billing status plus the API token used for subsequent calls. This is expected for the integration, but it still constitutes sensitive external transmission and raises risk because the skill also caches returned secrets locally.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials

• Confidence: 95% confidence
• Finding: The skill accesses existing local credentials and later acquires, stores, and reuses access tokens, refresh tokens, and API keys from the user's environment and home directory. In an agent context, credential access is inherently sensitive because compromise of the skill or overbroad triggering could expose or misuse long-lived authentication material.

Session Persistence

Medium

• Category: Rogue Agent

Content

if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break

• Confidence: 97% confidence
• Finding: The skill stores access_token and refresh_token in plaintext under ~/.bria/credentials, persisting authentication across sessions. Persistent local storage of bearer-style secrets increases the blast radius of local compromise, log leakage, or unintended reuse by other tools and is especially risky in shared or multi-agent environments.

Static analysis

No suspicious patterns detected.