Ai Product Description From Image

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 2.0.1

Overview

The skill has a coherent image-description purpose, but its script can upload any readable local file to xAI if given that path, not just validated product images.

Install only if you are comfortable with chosen local files being sent to xAI for processing. Until the script validates extensions, rejects symlinks, checks image content, and uses a size limit, avoid running it on untrusted paths or broad folders and keep it away from directories that may contain credentials, documents, or source code secrets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/script.sh:34

Finding

Arbitrary Local File Disclosure Due to Missing Image Validation

Content

View full analysis

&2 exit 1 fi _check_key IMAGE_PATH="$image_path" STYLE="$style" LANG="$lang" \ API_KEY="${XAI_API_KEY}" API_URL="$API_URL" \ python3 -u - << 'PYEOF' import urllib.request, json, sys, os, base64 API_KEY = os.environ["API_KEY"] API_URL = os.environ["API_URL"] image_path = os.environ["IMAGE_PATH"] style = os.environ["STYLE"] lang = os.environ["LANG"] ext = os.path.splitext(image_path)[1].lower() mime_map = {".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", ".webp": "image/webp"} mime = mime_map.get(ext, "image/jpeg") with open(image_path, "rb") as f: b64 = base64.b64encode(f.read()).decode() data_url = f"data:{mime};base64,{b64}" STYLE_INSTRUCTIONS = { "professional": "Write a formal, professional product description suitable for B2B buyers.", "casual": "Write a friendly, casual product description as if recommending to a friend.", "luxury": "Write a premium, aspirational product description for luxury shoppers.", "seo": "Write an SEO-optimized product description with keywords and bullet points.", } instruction = STYLE_INSTRUCTIONS.get(style, STYLE_INSTRUCTIONS["professional"]) lang_note = {"zh": " Write in Chinese.", "es": " Write in Spanish."}.get(lang, "") prompt = f"""{instruction}{lang_note} Analyze this product image and include: 1. What the product is 2. Key visible features and benefits 3. Who it is ideal for 4. A compelling call to action""" payload = json.dumps({ "model": "grok-2-vision-latest", "messages": [{ "role": "user", "content": [ {"type": "image_url", "image_url": {"url": data_url}}, {"type ...[truncated 2991 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities that require access to environment variables and outbound network calls, but it does not explicitly declare any tool scope or permission boundaries. This creates an authorization transparency gap: a caller may not realize the skill can access secrets like XAI_API_KEY and transmit local image-derived data to an external API, increasing the risk of unintended secret exposure or data exfiltration.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/script.sh (reported line 6)May include surrounding context.

sh

# Requires: XAI_API_KEY environment variable
set -euo pipefail

API_URL="https://api.x.ai/v1/chat/completions"

_check_key() {
    if [[ -z "${XAI_API_KEY:-}" ]]; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script base64-encodes the entire local image and sends it to x.ai's external API for processing, but it does not present an explicit warning, confirmation, or consent gate at the point of transmission. Because product images may contain sensitive or proprietary information, users can unknowingly exfiltrate local data to a third party, especially in batch mode.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The usage text restricts language selection to en|zh|es, and the prompt logic only supports English by default plus Chinese and Spanish. This can be a language/locale policy concern because the skill constrains output language to a fixed set without documenting why broader language support is unavailable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.