Security audit
Security checks for vulnerabilities and agentic risk
The skill’s image-editing purpose is coherent, but it directs users or agents to install many unpinned companion skills and send photos/prompts to Pruna’s API, which deserves review before use.
Review the Pruna data-handling expectations before sending private photos or confidential prompts, and prefer pinned or otherwise verified versions of companion skills instead of copying the unpinned install commands. This is not evidence of malicious behavior, but it expands trust to mutable external skill content and a third-party image API.
The trigger description is broad enough to match many ordinary image-editing requests without strong activation boundaries. Over-broad activation can cause the wrong skill to take control, leading to unintended external uploads, API use, or policy bypass through context confusion.
The skill instructs agents to install and invoke additional skills via npx skills add ... without pinning an immutable version or commit. That creates a supply-chain risk: a future package update, compromised registry entry, or retagged release could change agent behavior and introduce malicious instructions or code execution paths.
The skill relies on npx skills add for dependency installation without an immutable version pin. Because the fetched content can change over time, agents may consume unreviewed or malicious updates, expanding the trusted attack surface at runtime.
Using npx skills add with an unpinned dependency allows the installed skill contents to drift after this skill has been reviewed. An attacker who compromises the upstream package or release channel could cause arbitrary new instructions to be loaded into the agent workflow.
This dependency install command is not version-locked, so the agent may retrieve different content on different runs. In an agent-skill ecosystem, that is a meaningful supply-chain vulnerability because imported skills influence prompts, network behavior, and downstream actions.
The full-suite install command pulls a moving package tag rather than an immutable artifact. That amplifies risk because it can transitively introduce many changed skills at once, making review and provenance harder.
The alternate skill install command is also unpinned, preserving the same supply-chain weakness in the 'When NOT to use' section. Even guidance text can trigger insecure operational behavior if copied by users or agents.
This command references an external skill without version pinning, which can lead to unreviewed updates being executed or trusted by the agent. Because the skill is recommended as an alternative path, it still expands the attack surface.
The install command for the upscale skill is not immutable, allowing later package changes to alter agent behavior after review. In security terms, this is a standard dependency integrity problem affecting skill loading.
The skill instructs uploading user-provided reference images to an external API endpoint. External transmission of potentially sensitive images is a real security and privacy concern if users are not explicitly informed, data minimization is not applied, or enterprise environments prohibit third-party data egress.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/reference.png"
The skill instructs uploading user-provided reference images to an external API endpoint. External transmission of potentially sensitive images is a real security and privacy concern if users are not explicitly informed, data minimization is not applied, or enterprise environments prohibit third-party data egress.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/reference.png"
The create-prediction call sends prompts and image references to an external service, which may expose sensitive user content or metadata. In context this is expected functionality, but it still constitutes a true data-egress risk if not gated by consent, policy checks, and clear disclosure.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image-edit' \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "Change background to soft gradient, keep subject identical",
"images": ["https://api.pruna.ai/v1/files/FILE_ID"],
"aspect_ratio": "9:16"
}
}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "Change background to soft gradient, keep subject identical",
"images": ["https://api.pruna.ai/v1/files/FILE_ID"],
"aspect_ratio": "9:16"
}
}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
-d '{
"input": {
"prompt": "Change background to soft gradient, keep subject identical",
"images": ["https://api.pruna.ai/v1/files/FILE_ID"],
"aspect_ratio": "9:16"
}
}'
The synchronous prediction example sends data to the same third-party service, carrying similar confidentiality and compliance risks. The sync mode may make misuse easier because it is framed as a quick test, potentially encouraging less review before transmission.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image-edit' \
The follow-on installation guidance uses an unpinned package reference, meaning future executions may fetch changed code or instructions. Since follow-on skills are part of the expected workflow, they should be treated as trusted dependencies and locked accordingly.
This unpinned dependency creates the same supply-chain risk as earlier findings: mutable upstream content can silently change what an agent installs and follows. The risk is operationally relevant because these skills may influence external API use and content generation.
The skill recommends another package via npx skills add without a fixed version, exposing consumers to registry or maintainer compromise. Mutable dependencies are especially risky in agent ecosystems where imported text directly shapes actions.
This alternative install path is not pinned and therefore permits unreviewed future content to enter the workflow. If an attacker controls the upstream package or release tag, they could alter downstream agent behavior.
The follow-on skill reference remains mutable because no exact version is specified. That makes the recommendation a supply-chain entry point for malicious or accidental changes.
Another unpinned npx skills add command appears in the workflow chain, allowing untrusted drift over time. Since users may copy-paste these commands directly, the risk is practical rather than purely theoretical.
The avatar skill install command is unpinned, leaving consumers exposed to future package tampering or accidental breaking changes. In a security review, that is a true dependency management vulnerability.
This skill recommendation also relies on a mutable package reference, so the trusted workflow can be changed outside the reviewed file. That undermines reproducibility and security assurance.
The final follow-on install command is likewise unversioned, preserving a consistent supply-chain weakness throughout the document. The cumulative effect is larger because many adjacent skills may be installed from mutable sources.
No suspicious patterns detected.