Security audit

Image Generator

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it should be reviewed before install because it relies on mutable external installs and shows an unsafe API-key command pattern.

Install only if you trust AnyGen and are comfortable sending image prompts and reference assets to its service. Prefer browser login or a secret manager over pasting API keys into commands, and review the CLI package and workflow skill source/version before allowing automatic installation.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:12
Finding: Unpinned Executable Dependency and Non-Interactive Skill Installation
Content: View full analysis
-y ``` ``` ### Technical Analysis The Node.js dependency `@anygen/cli` is specified without a fixed version or integrity digest. Installation can therefore resolve to whatever package version the registry currently serves rather than the exact artifact reviewed during this audit. The installed CLI is subsequently instructed to retrieve and install an unspecified workflow skill. The `-y` option makes that installation non-interactive, reducing the opportunity to review the downloaded skill, its version, its permissions, and its instructions before installation. This creates a supply-chain trust boundary in which executable package content and Agent instructions can change after this skill has been reviewed. Exploitation depends on compromise or malicious control of the relevant package registry, publisher account, CLI distribution path, or workflow-skill distribution channel. ### Attack Path 1. An attacker compromises the `@anygen/cli` publisher account, package registry entry, or workflow-skill distribution channel. 2. The attacker publishes a modified CLI release or replaces the remotely distributed workflow skill with malicious content. 3. A user installs this skill without a version constraint, causing the current package release to be selected. 4. If the workflow skill is unavailable, the Agent runs `anygen skill install` with automatic confirmation enabled. 5. The malicious package code executes during installation or command invocation, or the malicious workflow instructions are loade ...[truncated 710 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:29
Finding: API Key Exposure Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is extremely broad, covering nearly any request involving images or design, which can cause the skill to trigger in situations the user did not intend. Because this skill sends work to an external server-side service, over-triggering increases the chance of unnecessary data disclosure, unintended tool execution, and user surprise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill states that image generation occurs server-side at an external service, but it does not clearly warn users before their prompts or assets may be sent off-platform. Without a prominent user-facing disclosure, users may unknowingly share sensitive text or images with a third party, creating privacy and compliance risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.