Security audit

Ai Image Generation

Security checks for vulnerabilities and agentic risk

Overview

The skill is for legitimate AI image generation, but its setup instructions ask users to run mutable remote installers that can execute code on their machine.

Review the installer before use, prefer a pinned/manual install with independent checksum or signature verification, avoid running setup from an elevated shell, and do not submit confidential prompts, images, URLs, or account data unless you accept disclosure to inference.sh and the selected model providers.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:17
Finding: Mutable Remote Installer Is Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation
' 'infsh.tar.gz' | sha256sum --check - ``` 6. Prefer cryptographic release signatures whose verification key is distributed through an independent, trusted channel. 7. Document the files and directories modified during installation. 8. Explicitly instruct users not to run the installer with `sudo`, as root, or from an administrator shell. 9. Where possible, use a reputable package manager with immutable version selection, integrity metadata, and reproducible installation behavior. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:116
Finding: Related Skills Are Installed Through Unpinned npx and Mutable Sources
Content: View full analysis
Remediation: View remediation
add ... ``` 2. Pin each related Skill to an immutable reviewed commit or signed release rather than a mutable branch or alias. 3. Provide expected integrity hashes or signature-verification instructions for downloaded artifacts. 4. Use a lockfile and a package-manager mode that enforces the lockfile wherever the installation workflow supports them. 5. Disable or explicitly review package lifecycle scripts when they are not required. 6. Document the publisher, source repository, exact version, and reviewed commit for every recommended dependency. 7. Keep these optional installations separate from the core setup path and warn users that they introduce additional third-party code and instructions. 8. Re-audit pinned versions before updating any dependency references. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill instructs users to execute a remote shell script directly via curl ... | sh, which is a classic unsafe pattern. Even with accompanying claims about checksum verification, piping a network-fetched script straight into the shell removes the user's ability to inspect it first and creates a direct remote code execution path if the hosting domain, transport, or script content is compromised.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
bash
# Install CLI curl -fsSL https://cli.inference.sh | sh && infsh login # Generate an image with FLUX infsh app run falai/flux-dev-lora --input '{"prompt": "a cat astronaut in space"}'

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest includes many broad trigger phrases such as generic image-generation and AI-art terms, which can cause the skill to activate for a wide range of common user requests. Over-broad triggering increases the chance this skill is selected unexpectedly, causing unintentional routing to external tooling and services.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill encourages sending prompts and potentially image URLs to third-party image-generation services but does not prominently warn users that their inputs leave the local environment. This creates privacy and data-handling risk, especially if users submit confidential prompts, proprietary images, or sensitive URLs.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: The documentation instructs users to run npx skills add ... without pinning a specific package version or commit. This can cause consumers to fetch whatever package state is current at execution time, increasing supply-chain risk if the package or a dependency is later compromised or changed unexpectedly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: This unpinned npx skills add invocation relies on mutable upstream package resolution. If the package publisher account, package contents, or dependency chain are compromised, users following the skill may execute attacker-controlled code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: Using npx skills without a pinned version creates non-reproducible and potentially unsafe installation behavior. The risk is elevated because this is presented as a ready-to-copy command in a skill document, making accidental execution likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: The command references a mutable package target via npx, which exposes users to future package drift or compromise. Because the skill is effectively an install guide, this is a practical software supply-chain weakness rather than a purely theoretical concern.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: An unversioned npx skills add command allows execution of whatever content is current at invocation time. In the event of upstream compromise, users could install or run unintended code simply by following the documentation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 79% confidence
Finding: This example depends on a non-pinned remote package resolution path, which weakens trust and reproducibility. The issue is not necessarily malicious here, but it is still a genuine supply-chain exposure in user-facing installation instructions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.