Don't download

• Outcome: Review
• Latest audit: May 28, 2026 · 1:56 AM UTC
• Version: 1.0.0

Overview

This appears to be a real Bria.ai image API skill, but it deserves review because it broadly activates for image requests, uploads images/prompts to Bria, and stores Bria credentials in plaintext for reuse.

Install only if you intend to connect a Bria.ai account and send selected images or prompts to Bria for processing. Avoid using it for private, regulated, or internal-only images unless Bria’s terms and your account settings are acceptable, and protect or remove ~/.bria/credentials when you no longer want this skill to make Bria API calls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill embeds substantial shell execution guidance but does not declare corresponding permissions, which weakens platform-level control and transparency around what the skill can do. In practice this can let a broadly-triggered skill run local shell commands that read files, write credentials, and invoke external services without an explicit permission boundary.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The top-level description tells the agent to use this skill for an extremely wide range of image-related requests, including ordinary transformation tasks and 'any visual content creation.' That overbroad trigger increases the chance the skill activates in situations where external API calls, auth flows, and local credential handling are unnecessary or unexpected.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The markdown guidance explicitly states that if the user mentions images, photos, visuals, or any visual content creation, the skill should be used. This is an ambiguous catch-all that can route benign image discussions or local-only editing requests into a workflow that sends data to a remote vendor and performs shell-based auth handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation directs callers to send image URLs, base64 image content, and API authentication headers to Bria's external service but does not clearly warn users that their data leaves the local system and is transmitted to a third party. In an image-processing skill, this omission can cause unintended disclosure of sensitive images, internal URLs, or credentials-bearing request metadata, especially when users may assume processing is local or first-party.

External Transmission

Medium

• Category: Data Exfiltration

Content

Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:

```bash
INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
  -d "token=$BRIA_ACCESS_TOKEN")
BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p')
if [ "$BILLING_STATUS" = "blocked" ]; then

• Confidence: 87% confidence
• Finding: The introspection call transmits the bearer access token to an external endpoint and returns additional sensitive account data, including billing status and an API token. In context this is part of intended authentication, but it still expands secret exposure and couples a broadly-triggered skill to transmission of high-value credentials to a remote service.

Credential Access

High

• Category: Privilege Escalation

Content

## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials

• Confidence: 97% confidence
• Finding: The skill instructs the agent to access, parse, and later persist authentication credentials from local files and API responses. Because the skill is broadly scoped and shell-enabled, this creates a real credential-access pathway that could expose or misuse bearer tokens, refresh tokens, and API keys beyond what users expect for a simple image request.

Session Persistence

Medium

• Category: Rogue Agent

Content

if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break

• Confidence: 98% confidence
• Finding: The skill stores access and refresh tokens in plaintext under ~/.bria/credentials, creating durable session persistence on disk. If the host, workspace, logs, backups, or other tools can read that file, an attacker could reuse the session and impersonate the user against Bria services.

Static analysis

No suspicious patterns detected.