Immich API Connector

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:19 PM UTC
• Version: 1.0.0

Overview

The skill matches its Immich photo-management purpose, but unsafe file-download and credential-handling patterns make it something users should review before installing.

Install only after reviewing the helper scripts. Use a narrowly scoped Immich API key, prefer environment variables or an interactive secret prompt over --api-key, require HTTPS except for explicitly trusted local testing, and avoid the download helper until album and filename path handling is sanitized and contained to the chosen output directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download_album.py:34

Finding

Path Traversal Through Server-Controlled Album and Asset Names

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload_photos.py:12

Finding

API Credentials and Private Media Can Be Transmitted Over Cleartext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload_photos.py:69

Finding

Immich API Key Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents and encourages network-capable actions against an external Immich instance but does not declare an explicit tool scope such as allowed-tools or permissions. That creates a governance gap: the agent could be invoked for network operations without clear least-privilege boundaries or user-visible constraints, increasing the chance of unintended outbound requests to sensitive self-hosted services.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are very broad, ending with 'Any Immich-related photo tasks,' which can cause the skill to activate for loosely related requests. In a skill that can access photo libraries, users, albums, and jobs on a self-hosted server, over-broad invocation increases the risk of unintended sensitive operations or data access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation shows passing the API key directly on the command line via --api-key, which commonly exposes secrets through shell history, process listings, telemetry, and logs. Because the API key grants access to photo assets and account-related endpoints, accidental disclosure could lead to unauthorized data access or service manipulation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Authentication

bash

# Test connection
curl -H "x-api-key: $IMMICH_API_KEY" "$IMMICH_URL/api/server-info/ping"

Base URL

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script uses album/API-controlled filenames directly when constructing local output paths, so a malicious or compromised Immich server could supply names containing path separators or traversal sequences and cause writes outside the intended album directory. In a download utility, this expands the tool's filesystem write scope beyond downloading media into a chosen folder and could overwrite user files or place attacker-controlled content in sensitive locations writable by the process.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/upload_photos.py (reported line 27)May include surrounding context.

python

album = next((a for a in albums if a.get("albumName") == album_name), None)
        
        if not album:
            resp = requests.post(f"{base_url}/api/albums", 
                                headers=headers,
                                json={"albumName": album_name})
            album = resp.json()

Static analysis

No suspicious patterns detected.