Pixshop MCP — 28+ AI Creative Tools

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed Pixshop MCP integration, but it requests broad local Bash and file-read authority that is not needed for its remote image/video workflow.

Review this before installing. Use it only if you are comfortable sending prompts, image URLs, portraits, product images, and publishable media to Pixshop and any backend providers it uses. Avoid confidential or regulated content unless Pixshop's terms and privacy practices fit your needs, and prefer a version that removes unnecessary Bash and local file-read permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4

Finding

Unnecessary Shell and Local File Access Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 4
Vulnerability Type: Excessive tool permissions violating the principle of least privilege
Risk Level: Medium

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill declares access to both Bash and Read, although its documented purpose is to connect to the Pixshop remote MCP service and invoke image and video processing tools. The documented workflows do not require arbitrary shell command execution or unrestricted access to local files.

Granting these capabilities expands the skill's security boundary beyond its stated functional requirements. If malicious instructions are introduced through compromised remote MCP responses, indirect prompt injection, or a future modification to the skill, the agent could be induced to read local files or execute shell commands. This finding concerns the excessive permissions declared by the skill; the audited file does not itself contain commands that actively exploit those permissions.

Attack Path

1. A user loads the skill, giving the agent access to the declared Bash and Read tools.
2. The agent communicates with the external Pixshop MCP endpoint as directed by the skill.
3. A compromised service response, attacker-controlled content processed during the workflow, or a later malicious instruction attempts to influence the agent.
4. Because the skill has unnecessary local capabilities, the influenced agent may read local files or execute shell commands unrelated to image or video processing.
5. Data obtained through those capabilities could potentially be exposed in subsequent tool requests or used to affect the local environment.

Impact Assessment

Successful exploitation could provide access to files readable by the user running the agent and allow command execution with that user's operating-system privileges. The practical scope depends on the host application's authorization con ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash and unrestricted Read from the allowed-tools declaration.
• Grant access only to the specific Pixshop MCP tools required for the documented image and video workflows.
• If local configuration access is genuinely necessary, restrict file operations to the exact MCP configuration file and use narrowly scoped read or write capabilities.
• Require explicit user confirmation before any local file access, shell execution, paid credit-consuming operation, biometric-image processing, or public publishing action.
• Treat responses and resources returned by the remote MCP service as untrusted data and prevent them from authorizing additional tool calls.
• Apply host-level sandboxing and outbound-data controls to limit the consequences of indirect prompt injection or remote-service compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs users to connect Claude/Cursor directly to a remote MCP endpoint at https://pixshop.app/api/mcp and extensively describes sending prompts, image URLs, and generated media to that service, but it does not clearly warn that user content will leave the local client and be processed by a third party. This can lead users to unknowingly transmit sensitive images, personal data, or proprietary prompts to an external provider, increasing privacy, compliance, and data-handling risk.

Content

No source excerpt is available for this finding.