Giggle Generation Image

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 8:38 PM UTC
• Version: 0.0.10

Overview

This skill is a disclosed Giggle image-generation client; it sends prompts and reference images to giggle.pro and returns generated-image links, with some privacy and dependency cautions but no hidden or destructive behavior found.

Install only if you are comfortable sending prompts, reference image URLs, base64 image content, asset IDs, and your Giggle API key to giggle.pro. Do not use sensitive private images or internal signed URLs unless you intend that service to process them, and avoid sharing returned signed image links broadly. Pinning requests before installation would improve reproducibility.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependency Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1
Vulnerability Type: Insecure dependency version and integrity controls
Risk Level: Low

Affected code:

text

requests>=2.31.0

Related Skill metadata also declares requests without an exact version:

yaml

requires:
  bins: [python3]
  env: [GIGGLE_API_KEY]
  pip: [requests]

Technical Analysis

The project permits any current or future requests release at or above version 2.31.0 and does not provide a package hash or a lock file for the dependency and its transitive dependencies. Consequently, installation is not reproducible and depends on mutable package-index state.

This does not prove that the current dependency is malicious. However, if a permitted future release, transitive dependency, or configured package index is compromised, installation or runtime code could execute under the account installing or running the Skill. Because the dependency processes authenticated HTTPS requests, compromised dependency code could access the GIGGLE_API_KEY, prompts, reference-image data, task identifiers, and API responses.

Attack Path

1. An attacker compromises a permitted future release of requests, one of its transitive dependencies, or the package index used by the environment.
2. A user installs the Skill dependencies using the unconstrained requests>=2.31.0 declaration.
3. The package resolver selects the compromised release because it satisfies the minimum-version constraint.
4. Malicious package code executes during installation, import, or request processing with the privileges of the installing or running user.
5. The malicious code may read process-accessible data, including GIGGLE_API_KEY, and intercept prompts, reference images, task IDs, or generated-image URLs.

Impact Assessment

Successful exploitation could execute code with the privileges of the user installing or running t ...[truncated 439 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin requests to an exact, reviewed version rather than using an open-ended minimum-version constraint:

   text

   requests==<audited-version>
   

2. Generate and enforce cryptographic hashes for the direct dependency and every transitive dependency, such as through a hash-locked requirements file:

   text

   requests==<audited-version> --hash=sha256:<verified-hash>
   

3. Use a reproducible lock-file workflow, such as pip-tools, and install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Pin and hash all transitive dependencies rather than relying only on a direct requests pin.

5. Obtain packages exclusively from an approved HTTPS package repository and restrict fallback or additional indexes to reduce dependency-confusion exposure.

6. Regularly review pinned versions for security advisories and update them through a controlled process that regenerates and verifies hashes.

7. Keep SKILL.md, SKILL.zh-CN.md, and package metadata consistent with the locked dependency installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to return full signed URLs containing Policy, Key-Pair-Id, and Signature parameters. Those are bearer-style access tokens for private assets, so exposing them directly to users or downstream systems can leak temporary privileged access and enable unauthorized retrieval or sharing of generated images.

Content

Scanner excerpt · SKILL.md (reported line 242)May include surrounding context.

md

Submit task → store task_id → inform user. When user asks for status, run query and forward stdout to user.

**Link return rule**: Image links in results must be **full signed URLs** (with Policy, Key-Pair-Id, Signature query params). Correct: `https://assets.giggle.pro/...?Policy=...&Key-Pair-Id=...&Signature=...`. Wrong: do not return unsigned URLs with only the base path (no query params).

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill requires environment access and makes outbound API calls, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where the agent may invoke capabilities not clearly constrained by policy, increasing the risk of unintended secret access or network use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include broad terms like 'draw' and 'create image,' which can overlap with many normal requests and cause the skill to activate unexpectedly. Over-broad activation can route unrelated prompts into code/network-capable behavior, expanding attack surface and making prompt-injection or unintended data handling more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad everyday phrases such as '画画' and '创建图片', which can cause the skill to activate in contexts where the user did not intend to invoke an external image-generation workflow. In this skill, accidental activation is more concerning because it can lead to transmission of user prompts or reference-image data to a third-party service and creation of asynchronous tasks without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation describes sending reference images via URL, Base64, or asset_id to giggle.pro, but it does not clearly warn that these user-supplied assets and prompts are transmitted to an external service. In an image-generation skill, this materially increases privacy and data-handling risk because users may provide sensitive images, signed URLs, or internal asset identifiers without realizing they leave the local environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python file contains natural-language descriptions and user-facing output entirely in Chinese, including the module docstring and runtime messages, with no indication that language selection is optional. Under the policy, forcing a specific language without user opt-in is a locale-policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

This script transmits user prompts, reference image data, and the API key to an external service at giggle.pro. In the context of an agent skill, that is a real data egress point: sensitive prompts, private image URLs/base64 content, or internal asset identifiers may be sent off-platform without any validation, minimization, allowlist enforcement beyond a hardcoded domain, or user-consent guardrails.

Content

Scanner excerpt · scripts/generation_api.py (reported line 173)May include surrounding context.

python

def _post(self, path: str, payload: Dict[str, Any]) -> Dict[str, Any]:
        url = f"{self.BASE_URL}{path}"
        try:
            resp = requests.post(url, headers=self.headers, json=payload, timeout=30)
            resp.raise_for_status()
            result = resp.json()
            if result.get("code") != 200:

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified as requests>=2.31.0, which allows any newer version to be installed without reproducibility or review. This weakens supply-chain control and can introduce vulnerable or breaking releases over time, even if the currently resolved version is safe.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.31.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because the manifest does not pin the requests version, it is impossible to determine whether deployment will use a release affected by known advisories. In a skill that likely performs network operations for image generation or retrieval, an unsafe requests version could expose credentials, weaken TLS-related behavior, or otherwise increase risk when handling remote URLs and APIs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.