Security audit

Anime Image Downloader (Safebooru, Download Only)

Security checks for vulnerabilities and agentic risk

Overview

This Safebooru image downloader is mostly coherent, but its network download path is broader than disclosed and lacks limits.

Install only if you are comfortable with a downloader that can make outbound requests based on URLs returned by Safebooru and redirects. Prefer running it in an isolated environment, keep counts small, restrict the output directory, and pin/audit dependencies before broader use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: safebooru_fetcher.py:127
Finding: Unvalidated API-Provided Download URLs Permit Server-Side Request Forgery
Content: View full analysis
List[Post]: pid = max(0, int(page) - 1) url = f"{POST_DAPI}&tags={quote(tags_expr)}&limit={int(limit)}&pid={pid}" r = http_get(url) if not r.text.strip(): return [] data = r.json() out: List[Post] = [] for item in data: fu = item.get("file_url") pid_ = item.get("id") if not fu or pid_ is None: continue out.append( Post( id=int(pid_), file_url=str(fu), preview_url=item.get("preview_url"), sample_url=item.get("sample_url"), rating=item.get("rating"), score=item.get("score"), ) ) return out ``` ```python def download_file(url: str, out_path: str, *, timeout: int = 60, retries: int = 3) -> None: def candidates(u: str) -> List[str]: parts = urlsplit(u) p = parts.path alts = [u] if p.lower().endswith(".jpg"): alts.append(urlunsplit((parts.scheme, parts.netloc, p[:-4] + ".png", parts.query, parts.fragment))) elif p.lower().endswith(".png"): alts.append(urlunsplit((parts.scheme, parts.netloc, p[:-4] + ".jpg", parts.query, parts.fragment))) return alts last_err: Optional[str] = None for cand in candidates(url): for attempt in range(retries): try: r = requests.get(cand, timeout=timeout, headers={"User-Agent": DEFAULT_UA}) if r.status_code == 404: last_err = "HTTP 404" break if r.status_code != 200: last_err = f"HTTP {r.status_code}" _sleep_backoff( ...[truncated 1906 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: safebooru_fetcher.py:133
Finding: Unbounded Response Buffering and Download Limits Permit Resource Exhaustion
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: requirements.txt:1
Finding: Open-Ended Dependency Constraint Reduces Supply-Chain Reproducibility
Content: View full analysis
=2.28.0 ``` ### Technical Analysis The dependency declaration sets a minimum version but no reviewed upper bound or exact version. A future installation can therefore resolve to a package release that was not part of the current audit. The project also does not provide hashes or a lock file to establish artifact integrity and reproducible resolution. The package name is legitimate and no malicious dependency was found. This is a supply-chain hardening weakness rather than evidence that the current dependency is compromised. ### Attack Path 1. A future environment runs `pip3 install -r requirements.txt`. 2. The package index resolves `requests` and its transitive dependencies to versions available at that time. 3. A compromised, unexpectedly changed, or incompatible future release falls within the open-ended constraint. 4. That release is installed and its code executes during installation or when the Skill imports and uses it. ### Impact Assessment The impact depends on the behavior and privileges of a hypothetical compromised dependency. Dependency code would execute with the same filesystem, network, and process privileges as the user running the installation or Skill. The current audit found no evidence of an existing malicious package or immediate compromise. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is specified as requests>=2.28.0, which allows installation of many different future versions and does not guarantee a reviewed, reproducible package set. This weakens supply-chain control and makes it harder to ensure the installed version is free from known vulnerabilities or breaking security changes.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 91% confidence
Finding: Because requests is not pinned, the manifest does not prove which release will actually be installed, and some requests versions have known security advisories. This creates a real supply-chain risk: an environment may resolve to a vulnerable version, leaving the skill exposed to issues such as credential leakage or other library-specific flaws.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.