T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/img2img.js:29- Finding
Arbitrary Local File Read and External Upload Through Image Argument
- Content
View full analysis
- Remediation
View remediation
Security audit
Agnes Image Generator
Security checks for vulnerabilities and agentic risk
Overview
This image-generation skill mostly matches its stated purpose, but it needs review because an included script can upload any readable local file to Agnes and the documentation understates public-output and credential risks.
Review before installing. Use only non-sensitive prompts and images, assume generated output links may be public, keep the Agnes API key in an environment variable or secret store instead of source code, and avoid using scripts/img2img.js on arbitrary paths unless you have verified the exact file being uploaded.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
README.md:14- Finding
Documentation Encourages Hardcoding an API Key in Source Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation examples are broad natural-language phrases that could cause the host agent to trigger the skill in situations the user did not clearly intend, especially because the README says the agent will 'automatically call this skill'. In an image-generation skill, overbroad triggering can lead to unintended API usage, cost incurrence, and sending user-supplied prompts or image URLs to a third-party service without sufficiently explicit consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README notes in technical details that outputs are stored as URLs in cloud storage and may be publicly accessible, but it does not prominently warn users before use that generated images could be exposed to anyone with the link. This creates a privacy and data-handling risk if users generate sensitive, proprietary, or personal images under the assumption that outputs are private.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states it will trigger automatically for any "image generation request," which is an overly broad activation condition. Broad auto-triggering can cause the skill to capture requests that were not intended for this specific tool, leading to unintended external API calls, unnecessary data disclosure to a third-party service, and reduced user control over when image prompts or reference images are sent out.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The README presents the skill behavior and invocation examples entirely in Chinese, including '直接对我说' followed by Chinese trigger examples, implying a fixed interaction language. There is no indication that other languages are supported or that Chinese-only behavior is a deliberate, justified regional constraint.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The tool description and parameter schema allow very broad image generation/editing behavior without specifying when the tool should be invoked or what safety boundaries apply. In an agent setting, this can lead to overuse or misuse of the tool for untrusted prompts, unsafe image edits, or unintended handling of external image URLs/Data URIs, increasing the chance of policy bypass or harmful content generation.
- Content
Static analysis
No suspicious patterns detected.