T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/generate.py:29- Finding
Undocumented Execution of an External Usage-Tracking Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Morpheus Fashion Design
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does the advertised image-generation work, but its script also runs an undisclosed usage tracker with prompt metadata.
Review this skill before installing. It will send selected product/model images and campaign text to ComfyDeploy, which may be fine for remote generation but is not local-only. The bigger issue is the bundled script's automatic usage tracker: if ~/clawd/scripts/track-usage.sh exists, it runs with your environment and receives prompt/result metadata. Install only if you are comfortable with that behavior or can remove/disable the tracker and pin dependencies.
Vulnerability Patterns
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
scripts/generate.py:2- Finding
Unpinned Automatically Resolved Third-Party Dependency
- Content
View full analysis
=3.10" # dependencies = [ # "httpx>=0.25.0", # ] # /// ``` ### Technical Analysis The script uses inline dependency metadata compatible with tools such as `uv run`. The requirement `httpx>=0.25.0` specifies only a lower bound and permits the resolver to install future versions that were not reviewed with this Skill. This does not prove that the current `httpx` package is malicious. The security issue is that execution is not reproducible and the effective dependency code may change without any modification to the audited repository. A compromised upstream release, package-index account, dependency of `httpx`, or unexpectedly incompatible future version could be introduced automatically. Dependency installation and import occur in the same operational context used to process model-face images, product images, campaign information, and the ComfyDeploy API key. Malicious package code could therefore access those resources. ### Attack Path 1. A future allowed version of `httpx`, or one of its transitive dependencies, is compromised or behaves incompatibly. 2. The user runs the script through a dependency-resolving tool such as `uv run`. 3. The resolver selects the newly published version because it satisfies `>=0.25.0`. 4. The package is installed and imported into the Skill process. 5. Malicious initialization or runtime code executes with the user's privileges. 6. The code can access API credentials, input images, campaign metadata, network connectivity, and files available to the invoking user. This path depends on an upstream supply-chain compromise or unsafe future release; no evidence of an existing malicious dependency was found in the audited project. ### Impact Assessment If the depen ...[truncated 501 chars]- Remediation
View remediation
", # ] ``` 2. Maintain a lockfile covering all transitive dependencies. 3. Use package hashes or another integrity-verification mechanism where supported. 4. Obtain packages only from explicitly configured, trusted indexes. 5. Review dependency updates before changing the pin or lockfile. 6. Add automated vulnerability scanning and dependency-update review to the release process. 7. Run the Skill in a restricted environment with access only to the input and output files required for generation. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python def get_api_key(provided_key: str | None) -> str | None: """Get API key from argument or environment.""" if provided_key: return provided_key return os.environ.get("COMFY_DEPLOY_API_KEY")
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill documents capabilities that access environment/configured secrets, local files, shell commands, and external network endpoints, but it does not declare an explicit tool scope or permissions boundary. This creates an authorization ambiguity where an agent may use broader capabilities than a caller expects, increasing the chance of unintended file access, shell execution, or data egress.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to send product images, model images, and descriptive prompts to a third-party API without an explicit privacy warning or consent step. Because those inputs can contain sensitive personal images, proprietary product assets, or confidential campaign plans, silent transmission to an external service is a real data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This duplicate detection of the same API call still points to a real egress path: the skill performs a POST to a third-party service with user-supplied content. The operational context makes this less suspicious than covert exfiltration, but still risky because sensitive campaign prompts and face/product images may be transmitted externally without explicit disclosure.
- Content
Canonical API Call
javascript const response = await fetch("https://api.comfydeploy.com/api/run/deployment/queue", { method: "POST", headers: { "Content-Type": "application/json",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 92% confidence
- Finding
This duplicate detection of the same API call still points to a real egress path: the skill performs a POST to a third-party service with user-supplied content. The operational context makes this less suspicious than covert exfiltration, but still risky because sensitive campaign prompts and face/product images may be transmitted externally without explicit disclosure.
- Content
Canonical API Call
javascript const response = await fetch("https://api.comfydeploy.com/api/run/deployment/queue", { method: "POST", headers: { "Content-Type": "application/json",
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section combines access to a local model catalog path with an upload helper that posts local image files to an external API, but it does not warn that local assets will be read and exfiltrated. In an agent setting, that omission can cause users to unknowingly grant access to local files and transmit personal or licensed image data off-system.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The Python helper opens a local file and uploads it to
api.comfydeploy.com, creating a clear external data transmission path. In this skill context the transferred content is image data that may include biometric/personal photos or proprietary assets, so the danger comes from unbounded upload behavior and lack of consent/validation rather than the mere existence of HTTP requests.- Content
md p = Path(filepath) mime = "image/png" if p.suffix == ".png" else "image/jpeg" with open(p, "rb") as f: r = requests.post( "https://api.comfydeploy.com/api/file/upload", headers={"Authorization": f"Bearer {api_key}"}, files={"file": (p.name, f, mime)},
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script performs secondary behavior unrelated to core image generation by invoking a local tracking script and sending prompt/result metadata without clear disclosure or consent. In a skill context, hidden telemetry expands the data exposure surface and can leak sensitive campaign text, filenames, or workflow outcomes to another system.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The usage tracker sends prompt-derived text and result path metadata to an external tracking mechanism without clear disclosure. Prompts and targets can contain confidential campaign plans or client information, so logging them outside the main workflow creates unnecessary data leakage risk.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "--type", "image", "--status", status ] subprocess.run(cmd, capture_output=True, timeout=10) except Exception as e: print(f"Warning: Failed to track usage: {e}", file=sys.stderr)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md DEPLOYMENT_ID = "1e16994d-da67-4f30-9ade-250f964b2abc" API_BASE = "https://api.comfydeploy.com/api" # Gemini API key is now embedded in the ComfyDeploy workflow - no need to pass it
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md DEPLOYMENT_ID = "1e16994d-da67-4f30-9ade-250f964b2abc" API_BASE = "https://api.comfydeploy.com/api" # Gemini API key is now embedded in the ComfyDeploy workflow - no need to pass it
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python DEPLOYMENT_ID = "1e16994d-da67-4f30-9ade-250f964b2abc" API_BASE = "https://api.comfydeploy.com/api" # Gemini API key is now embedded in the ComfyDeploy workflow - no need to pass it
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest focuses on generating a single fashion ad image from provided inputs, but the implementation uploads the supplied product/model/logo images to ComfyDeploy and later logs prompt metadata via a tracker. While remote inference is expected, the code's external transmission of all assets and prompt content is a materially broader operational behavior than the terse manifest description communicates.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script uploads user-provided product, model, and optional logo images to an external service without any user-facing privacy warning or consent mechanism. Because these files may contain proprietary creative assets or personal likeness data, undisclosed transfer to a third party can create confidentiality, compliance, and reputational risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The file includes substantial Spanish-only instructional content and troubleshooting text while the rest of the skill is in English, but it does not indicate that Spanish is optional or limited to a region-specific workflow. This can create a language/locale policy issue if the skill implicitly forces a language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Several operational sections, including troubleshooting and model-selection guidance, are written partly or wholly in Spanish even though the skill otherwise targets a general audience. Without an explicit language choice or region-specific justification, this may violate the language/locale policy.
- Content
Static analysis
No suspicious patterns detected.