Don't download

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

This Bria image skill is coherent but needs Review because it broadly auto-activates an authenticated cloud service and handles reusable credentials and private images with unsafe shell patterns.

Install only if you are comfortable sending selected images, image URLs, and prompts to Bria.ai and storing Bria credentials locally. Before use, restrict ~/.bria permissions, avoid sensitive images or secrets in prompts, and do not run the shell helper in environments where BRIA_API_BASE or API responses could be influenced by untrusted parties.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:95

Finding

Credential files are created without enforced restrictive permissions

Content

View full analysis

"$HOME/.bria/credentials" echo "AUTHENTICATED" break ``` The API token is subsequently written through another temporary credential file: ```bash grep -v '^api_token=' "$HOME/.bria/credentials" > "$HOME/.bria/credentials.tmp" 2>/dev/null || true printf 'api_token=%s\n' "$BRIA_API_KEY" >> "$HOME/.bria/credentials.tmp" mv "$HOME/.bria/credentials.tmp" "$HOME/.bria/credentials" ``` ### Technical Analysis The authentication flow stores an access token, refresh token, and API token in `~/.bria/credentials`, but it does not enforce restrictive permissions on either the directory or the files. The resulting permissions depend on the caller's current `umask`. On a system with a permissive `umask`, another local user may be able to read these reusable credentials. The intermediate `credentials.tmp` file has the same issue and may temporarily expose the API token during an update. The code also does not verify that the credential directory and existing files are owned by the current user and are not symbolic links. Credential storage is necessary for the declared Bria API functionality, but storing credentials without explicit access controls exceeds the minimum safe privilege boundary. ### Attack Path 1. A user runs the documented Bria device-authentication flow under a permissive `umask`. 2. The Skill creates `~/.bria/credentials` or `~/.bria/credentials.tmp` without explicitly setting mode `0600`. 3. Another local account inspects the file while it exists. 4. The attacker extracts the access token, refresh token, or Bria API token. 5. The attacker submits requests to Bria using the victim's credentials. ### Impact Assessment A successful exploit c ...[truncated 343 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/code-examples/bria_client.sh:36

Finding

Predictable temporary files can expose private images and permit symlink attacks

Content

View full analysis

"$payload" elif printf '%s' "$image" | grep -qE '^https?://'; then if [ "$key" = "images" ]; then printf '{"images": ["%s"]' "$image" > "$payload" else printf '{"%s": "%s"' "$key" "$image" > "$payload" fi else [ ! -f "$image" ] && { echo "ERROR: File not found: $image" >&2; return 1; } if [ "$key" = "images" ]; then printf '{"images": ["' > "$payload" else printf '{"%s": "' "$key" > "$payload" fi base64 < "$image" | tr -d '\n' >> "$payload" if [ "$key" = "images" ]; then printf '"]' >> "$payload" else printf '"' >> "$payload" fi fi if [ -n "$extra" ]; then if [ -z "$image" ]; then printf '%s' "$extra" >> "$payload" else printf ', %s' "$extra" >> "$payload" fi fi printf '}' >> "$payload" # --- API call --- result="/tmp/bria_result_$$.json" http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \ "${BRIA_API_BASE}${endpoint}" \ -H "api_token: $BRIA_API_KEY" \ -H "Content-Type: application/json" \ -H "User-Agent: $BRIA_USER_AGENT" \ -d @"$payload") body=$(cat "$result") rm -f "$payload" "$result" ``` ### Technical Analysis The helper constructs temporary paths from the process ID and creates them through ordinary shell redirection and `curl -o`. Process IDs are predictable, and the files are placed in the shared `/tmp` directory without exclusive creation, randomized names, symlink checks, or explicit restrictive permissions. The payload can contain a complete local image encoded in base64, along with user prompts and editing instructions. The result file can contain service metadata and generated-image URLs. File visibility depends ...[truncated 1449 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/code-examples/bria_client.sh:14

Finding

Environment-controlled API base URL can redirect credentials and image data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/code-examples/bria_client.sh:98

Finding

API key is sent to an unvalidated status URL returned by the server

Content

View full analysis

` to the attacker-controlled host. 5. The attacker records and reuses the Bria API key. ### Impact Assessment A successful exploit discloses the reusable Bria API key to an arbitrary remote host. The attacker may use the key to invoke Bria APIs, consume the victim's quota, and impersonate the victim within the API key's authorization scope. This fin ...[truncated 104 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill instructs the agent to locate, read, and use persisted access credentials from ~/.bria/credentials. Accessing local secrets is a high-sensitivity operation; combined with broad activation and shell access, it can let unrelated user requests trigger credential discovery and reuse without clear scoping or consent.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

## Setup — Authentication

Before making any API call, you need a valid Bria access token.

### Step 1: Check for existing credentials

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill directs shell-side deletion of ~/.bria/credentials when the token is inactive. While intended as cleanup, file deletion is a state-changing operation on the user's home directory and, without tightly scoped tool permissions and path controls, establishes a pattern of filesystem mutation that can be abused or misapplied by an agent.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

fi
ACTIVE=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"active" *: *\([^,}]*\).*/\1/p' | tr -d ' ')
if [ "$ACTIVE" = "false" ]; then
  rm -f ~/.bria/credentials
  echo "TOKEN_EXPIRED"
fi
BRIA_API_KEY=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"api_token" *: *"\([^"]*\)".*/\1/p')

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill embeds substantial shell-based behavior but does not declare any explicit tool scope or allowed tools. That increases the chance an agent grants broader execution than necessary and makes review of filesystem/network effects harder, especially because the skill reads local credentials, writes token files, and performs outbound API calls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: bria-ai
description: AI image generation, editing, and background removal API via Bria.ai — remove backgrounds to get transparent PNGs and cutouts, generate images from text prompts, and edit photos with natural language instructions. Also create product photography and lifestyle shots, replace or blur backgrounds, upscale resolution, restyle, and batch-generate visual assets. Use this skill whenever the user wants to remove a background, create transparent PNGs, generate, edit, modify, or transform any image — including hero images, banners, social media visuals, product photos, illustrations, icons, thumbnails, ad creatives, or marketing materials. Also triggers on cutout, inpainting, outpainting, object removal or addition, photo restoration, style transfer, image enhancement, relight, reseason, sketch-to-photo, or any visual content creation. Commercially safe, royalty-free. 20+ specialized endpoints for e-commerce, web design, and content pipelines.
license: MIT
metadata:
  author: Bria AI

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The front-matter description says to use the skill for essentially any image-related request, which is overly broad for an authenticated, shell-capable integration. Overbroad activation can cause the agent to invoke this skill in situations where a simpler local or safer skill would suffice, unnecessarily exposing user images, prompts, or credentials to an external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The usage guidance explicitly instructs invocation whenever the user mentions images, photos, or visuals, regardless of whether Bria is necessary. In context, this is risky because the skill can trigger auth flows, read cached credentials, and upload user-supplied images to third-party APIs based on ambiguous requests.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The device authorization step initiates outbound communication to Bria and echoes the authorization response, which includes sensitive flow material such as a device code. Although external transmission is expected for this integration, exposing or mishandling auth artifacts can enable account-linking abuse or leak session-related data into logs.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

2a. Request a device code:

bash

DEVICE_RESPONSE=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/device/authorize" \
  -H "Content-Type: application/json")
echo "$DEVICE_RESPONSE"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

The skill persists access_token and refresh_token to a plaintext file under ~/.bria/credentials for reuse across sessions. Persisting long-lived auth material on disk increases the blast radius of local compromise, accidental disclosure, or cross-skill access, especially because no file permission hardening or secret-store integration is described.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

if [ -n "$ACCESS_TOKEN" ]; then
    BRIA_ACCESS_TOKEN="$ACCESS_TOKEN"
    REFRESH_TOKEN=$(printf '%s' "$TOKEN_RESPONSE" | sed -n 's/.*"refresh_token" *: *"\([^"]*\)".*/\1/p')
    mkdir -p ~/.bria
    printf 'access_token=%s\nrefresh_token=%s\n' "$BRIA_ACCESS_TOKEN" "$REFRESH_TOKEN" > "$HOME/.bria/credentials"
    echo "AUTHENTICATED"
    break

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The token introspection call transmits the bearer token to an external endpoint to derive billing status and an API key. This is functionally necessary, but it increases security sensitivity because compromise of request handling, logging, or an unintended endpoint would expose a credential that can authorize downstream API activity.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

Introspect the bearer token to check billing status and obtain the real API key for Bria API calls:

bash

INTROSPECT=$(curl -s -X POST "https://engine.prod.bria-api.com/v2/auth/token/introspect" \
  -d "token=$BRIA_ACCESS_TOKEN")
BILLING_STATUS=$(printf '%s' "$INTROSPECT" | sed -n 's/.*"billing_status" *: *"\([^"]*\)".*/\1/p')
if [ "$BILLING_STATUS" = "blocked" ]; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The reference shows prompt-driven generation and editing but omits a warning that prompts, instructions, object names, and related text are sent to an external API. Because users often place confidential or personal data into freeform prompts, this omission can lead to unintended disclosure of sensitive business information or personal data to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The API reference documents endpoints that accept image URLs and base64 image content but does not warn that those images are transmitted to Bria's external service for processing. Users may mistakenly submit private, regulated, or proprietary images without informed consent, creating confidentiality, privacy, and compliance risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The helper implicitly reads an API token from ~/.bria/credentials without an explicit opt-in at call time. In a sourced shell helper, this can cause unexpected use of local secrets and silently authorize remote requests, which is risky because the skill's stated purpose is image processing, not credential discovery or secret management.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The function auto-loads credentials and can transmit image data or image URLs to a third-party API with no inline warning or confirmation. This is dangerous because users may unknowingly send sensitive local images or proprietary content off-host under existing credentials simply by calling the helper.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/code-examples/bria_client.sh (reported line 71)May include surrounding context.

sh

# --- API call ---
  result="/tmp/bria_result_$$.json"
  http_code=$(curl -s -o "$result" -w '%{http_code}' -X POST \
    "${BRIA_API_BASE}${endpoint}" \
    -H "api_token: $BRIA_API_KEY" \
    -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.