Phy Ai Image

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 AM UTC
• Version: 1.0.2

Overview

This image-generation skill is mostly coherent, but it needs review because it can send user images to fal.ai, save generated files locally, and automatically rewrite safety-blocked prompts.

Review this skill before installing if you may use private, client, biometric, or sensitive images. It uses fal.ai with an API key, may upload local reference images to that provider, may save generated outputs locally, and should be changed so safety-blocked prompts are not automatically rewritten for another attempt.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The manifest description says the skill triggers on broad phrases like 'any image creation request,' which can cause the skill to activate in contexts the user did not clearly intend. Over-broad activation increases the chance of unsolicited external API use, prompt processing, file writes, or privacy-sensitive handling of images.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The instruction to act whenever a user 'mentions image creation' is ambiguous and can make the agent take over ordinary brainstorming or adjacent conversations without clear consent. In this skill, activation can lead to prompt enhancement, model selection, network calls, and saving outputs locally, so accidental invocation has meaningful security and privacy implications.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill instructs uploading reference images to fal.ai or using public URLs, but it does not provide a clear privacy warning that user images may be transmitted to a third-party service. Reference images can contain sensitive personal, proprietary, biometric, or location-revealing information, making this especially risky in an image-editing workflow.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The sample code downloads generated images to '~/Pictures/ai-image/output.jpg' without any explicit warning or consent flow about writing files to local disk. Silent local persistence can expose sensitive or embarrassing generated content to other local users, backups, indexing services, or later unintended disclosure.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage

Content

| Error Type | Detection | Recovery |
|-----------|-----------|----------|
| **Safety/content** | "safety", "policy", "flagged" | Auto-rephrase prompt, offer cleaned version |
| **Rate limit** | 429, "rate limit" | Wait 30s and retry once |
| **Model unavailable** | "not found", "inactive" | Suggest alternative from `/fal-model-selector` |
| **Invalid size/ratio** | "not supported" | Show valid options |

• Confidence: 75% confidence
• Finding: Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Ssd 1

Medium

• Confidence: 98% confidence
• Finding: The instruction to auto-rephrase prompts that were blocked for safety or policy reasons can function as a semantic bypass of model safeguards. This encourages the system to transform disallowed user requests into alternate wording until the provider accepts them, undermining upstream safety controls and potentially enabling prohibited or harmful content generation.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The examples read FAL_API_KEY from the environment, which involves access to a credential. The markdown labels it as setup but does not explicitly warn users that the skill depends on and will use an API credential for external requests.

Static analysis

No suspicious patterns detected.