ClawHub
Back to skill

Security audit

p-image-ideogram

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent image-generation skill that sends prompts to Pruna's API, with a supply-chain caution around unpinned example install commands.

Install this only if you are comfortable sending image prompts and generation settings to Pruna's API using your Pruna API key. Before copying the example `npx skills add` commands, consider pinning to reviewed versions or verifying the source because the documented examples use floating package references.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · references/domain-configurations.md (reported line 5)May include surrounding context.

md
Use with **`p-image-ideogram`** when a **`vertical-*`** workflow (or any brief) implies a job type. **SSoT for knobs:** `thinking`, `image_size`, prompt form (natural language vs Ideogram JSON), and batch discipline. **Agent default:** **`thinking: high`**, **`prompt_upsampling: true`**. Set **`prompt_upsampling: false`** for JSON prompts, locked on-image copy, or verbatim wording.

**Before POST:** list exact on-image strings in the plan; pick the profile below; show prompt + knobs unless the user locked wording.

## Profiles

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to execute npx skills add ... commands without pinning an exact immutable version. This can cause installation of a newer or compromised package/tag than the author reviewed, creating a supply-chain risk if the upstream package, tag, or resolver behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The referenced npx skills add install path is not pinned to an immutable dependency version. That leaves consumers exposed to supply-chain compromise or unexpected code changes when the package or tag updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This installation command relies on npx with a non-immutable package reference, which means the executed content can drift over time. If the upstream package is hijacked or modified, users may run attacker-controlled code during install.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The full-suite install command uses npx skills add with a floating suite reference rather than a locked release. This creates avoidable supply-chain exposure because later installs may fetch unreviewed content.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This alternative-skill install instruction again uses an unpinned npx package reference. Repeated unpinned examples normalize unsafe installation practices and increase the chance of downstream code execution from compromised upstream artifacts.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill directs installation of another package via npx skills add without an immutable version. Because npx may fetch and execute package code, any upstream compromise could directly affect users.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This install command continues the pattern of unpinned remote dependency execution. The risk is a classic supply-chain issue: package updates or namespace compromise can introduce malicious code without any local change to the skill file.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Create (async — recommended)

bash
curl -X POST 'https://api.pruna.ai/v1/predictions' \
  -H 'Content-Type: application/json' \
  -H "apikey: ${PRUNA_API_KEY}" \
  -H 'Model: p-image-ideogram' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Create (async — recommended)

bash
curl -X POST 'https://api.pruna.ai/v1/predictions' \
  -H 'Content-Type: application/json' \
  -H "apikey: ${PRUNA_API_KEY}" \
  -H 'Model: p-image-ideogram' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

Create (async — recommended)

bash
curl -X POST 'https://api.pruna.ai/v1/predictions' \
  -H 'Content-Type: application/json' \
  -H "apikey: ${PRUNA_API_KEY}" \
  -H 'Model: p-image-ideogram' \

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The follow-on skill installation example uses npx with a non-pinned package reference. This creates a realistic chance of unauthorized code execution if the upstream dependency changes or is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This command executes remote package installation without locking the exact package version. In a skill ecosystem where users may copy-paste commands, that materially increases supply-chain attack exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill recommends another package via npx skills add but does not pin it immutably. If the package publisher account, tag, or package contents are later altered, users could execute untrusted code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The command at this line is an unpinned npx install reference and therefore susceptible to dependency drift and supply-chain compromise. This is especially relevant because users are explicitly instructed to install and load additional skills before use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

An unversioned or non-immutable npx install command can fetch different code over time. Attackers often target this pattern through compromised publishers or poisoned updates, making it a real supply-chain weakness rather than a theoretical one.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This install snippet exposes users to package substitution or malicious updates because it does not pin the exact artifact being installed. The repeated pattern across the skill amplifies the risk by encouraging broad copy-paste adoption.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The final listed npx skills add command is also unpinned, preserving the same supply-chain vulnerability. Since installation executes external package logic, compromise of the referenced source could lead to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.