Security checks for vulnerabilities and agentic risk
Overview
This skill is mostly a legitimate image-generation client, but it has serious under-disclosed network and credential-safety risks.
Install only if you trust the SAA backend and understand the network risk. Avoid using real credentials over WSS until TLS verification is fixed, prefer local trusted endpoints, review commands that include usernames or passwords, and require explicit confirmation before using skeleton-key or overwriting important output files.
For every user-selected wss:// endpoint, the client disables both certificate-chain validation and hostname verification. The same insecure SSL context is used for the HTTPS login request carrying the SAA username and password and for the subsequent WebSocket connection.
Although the traffic remains encrypted, the client does not authenticate the server. Any certificate presented by an intermediary is therefore accepted, including a self-signed certificate for an unrelated hostname. This defeats the identity guarantees expected from HTTPS and WSS.
Attack Path
The user invokes the Skill with a legitimate wss:// SAA backend and supplies authentication credentials.
An attacker capable of intercepting or redirecting network traffic—such as a hostile local-network participant, compromised gateway
...[truncated 1127 chars]
Remediation
View remediation
Remediation Suggestions
Use the platform-default verified TLS context for HTTPS and WSS:
python
ssl_context = ssl.create_default_context()
Do not modify check_hostname or verify_mode.
Allow private or self-signed deployments to provide an explicit CA certificate file:
python
If an insecure compatibility mode is unavoidable, place it behind an explicit option such as --insecure-skip-tls-verify, keep it disabled by default, and display a prominent warning before credentials are transmitted.
Apply the same verification policy consistently to both the /api/login HTTPS request and the WebSocket connection.
Add tests confirming that certificates with an untrusted issuer, expired certificates, and hostname mismatches are rejected by default.
Avoid documenting insecure mode as the standard solution for self-signed deployments; document installation or selection of the correct CA certificate instead.
TLS certificate verification is disabled for both HTTPS login and WSS connections by setting hostname checks off and verification mode to CERT_NONE. This enables man-in-the-middle attacks against authentication and image-generation traffic, allowing attackers on the network path to steal credentials/tokens or tamper with requests and responses.
Content
No source excerpt is available for this finding.
Exfiltration Commands
High
Category
Prompt Injection
Confidence
90% confidence
Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
Content
Scanner excerpt · saa-agent.py (reported line 547)May include surrounding context.
python
async def send_message(self, message: Dict, allow_reconnect: bool = True) -> Optional[Dict]: # noqa S3776
"""
Send message to WebSocket server and wait for response
Args:
message: Message dictionary
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill documents networked behavior via WebSocket access but does not declare any explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may be allowed to initiate outbound network actions without clear policy constraints, reducing reviewability and increasing the chance of unintended or unsafe remote interactions.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill authorizes direct execution without prior user disclosure even though the command may include credentials and sends network requests to a user-supplied WebSocket endpoint. This lowers informed consent and increases the risk of credential exposure, misuse of secrets in shell history/logs, and unintended interaction with malicious or untrusted endpoints.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
90% confidence
Finding
The instruction to execute by default without asking grants the agent autonomous authority to launch an external CLI that performs networked image-generation actions. In this context, the autonomy is more dangerous because the tool can contact user-provided endpoints, consume compute resources, and potentially use secrets, so lack of an approval checkpoint increases the chance of unintended operations.
Content
Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.
md
These rules help maintain appropriate transparency and user control when executing generation tasks.
1. **Command Execution & User Notification**
By default, execute the command directly without asking for confirmation.
Show the full command and ask for approval only when:
- The user explicitly requests to review it first
- The operation involves sensitive or high-impact parameters
Ssd 3
Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding
The default reporting behavior tells the agent to echo positive and negative prompts, seeds, and output details back in plain text. Prompts may contain sensitive personal, proprietary, or policy-relevant information, and reflecting them into logs or transcripts increases data exposure beyond what is necessary to report success.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding
The skill first instructs agents not to retry when the backend is busy, but later recommends retrying once with --verbose on failure. In practice, ambiguous failure-handling guidance can cause agents to retry busy or locked backends anyway, potentially worsening congestion, interfering with other users, or triggering forceful recovery flows inappropriately.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill includes a 'skeleton key' capability explicitly described as unlocking the backend atomic lock, which exceeds normal image-generation functionality and can bypass safety or concurrency controls enforced by the backend. In an agent-exposed skill, this is dangerous because a caller can trigger state-changing administrative behavior that may disrupt other users' jobs or defeat intended operational safeguards.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding
The callback always decodes received image data and writes it to the configured output path on disk. While the CLI exposes an --output parameter, the code and help text do not clearly warn that generated content is always persisted locally and may overwrite an existing file, which is a user-data-impacting operation.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The CLI exposes a --skeleton-key option that allows force-unlocking backend state from the command line, making an administrative override available through routine user inputs. In the context of an agent skill, this increases the chance of accidental or unauthorized invocation and can interfere with backend integrity, job isolation, or availability.
