p-image-try-on

• Outcome: Pass
• Latest audit: Aug 28, 2026 · 8:05 AM UTC
• Version: 1.0.10

Overview

The skill appears to do what it says, but it sends photos and prompts to Pruna’s external API for processing.

Before installing or using this skill, confirm you are comfortable sending person photos, garment images, pose references, and prompts to Pruna’s remote service. Use images you have rights and consent to upload, avoid sensitive or regulated photos, and review the related Pruna prerequisite skills before allowing the suggested npx installs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs agents to upload person photos, garment images, and optional pose references to a third-party API, but does not require any user-facing disclosure that these images will leave the local environment. Because person photos may contain sensitive biometric or personal data, this omission can lead to unintended data disclosure and privacy non-compliance.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example workflow instructs users to send prompts and image references, including a person photo, to an external API without any explicit privacy notice, consent guidance, or warning that personal images and metadata leave the local environment. In a try-on skill, this is especially sensitive because user-supplied photos may contain biometric or identifying information, making silent third-party transmission a real privacy and compliance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H 'Model: p-image-try-on' \
  -d '{
    "input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
      "garment_images": ["https://api.pruna.ai/v1/files/GARMENT_FILE_ID"]
    }
  }'

• Confidence: 95% confidence
• Finding: This endpoint sends user-supplied person and garment image URLs to an external service for processing. In this skill's context that behavior is expected, but it is still security-relevant because it transmits potentially sensitive personal imagery to a remote provider and the skill lacks an explicit consent/privacy gate.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H 'Try-Sync: true' \
  -d '{
    "input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
      "garment_images": ["https://api.pruna.ai/v1/files/GARMENT_FILE_ID"]
    }
  }'

• Confidence: 95% confidence
• Finding: The synchronous API example also transmits person and garment imagery to a remote endpoint. The risk is the same as the async variant: not malicious exfiltration, but a real privacy exposure if users are not clearly informed and images contain identifiable individuals.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H 'Model: p-image-try-on' \
  -d '{
    "input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
      "garment_images": [
        "https://api.pruna.ai/v1/files/MULTI_GARMENT_SHOT_ID",
        "https://api.pruna.ai/v1/files/BOTTOM_ID"

• Confidence: 95% confidence
• Finding: This extended example submits person and garment references to an external API. Because the skill is centered on handling user photos, the external transmission is functionally necessary, but it remains a true privacy/security concern without prominent disclosure and safe-data handling instructions.

External Transmission

Medium

• Category: Data Exfiltration

Content

"input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
      "garment_images": [
        "https://api.pruna.ai/v1/files/MULTI_GARMENT_SHOT_ID",
        "https://api.pruna.ai/v1/files/BOTTOM_ID"
      ],
      "reference_pose": "https://api.pruna.ai/v1/files/POSE_REF_ID",

• Confidence: 95% confidence
• Finding: The garment image references shown here are part of a remote-processing workflow and therefore involve external transmission of user-provided content. Even though this is expected model usage, it can expose personal or proprietary imagery if the user is not adequately warned.

External Transmission

Medium

• Category: Data Exfiltration

Content

"person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
      "garment_images": [
        "https://api.pruna.ai/v1/files/MULTI_GARMENT_SHOT_ID",
        "https://api.pruna.ai/v1/files/BOTTOM_ID"
      ],
      "reference_pose": "https://api.pruna.ai/v1/files/POSE_REF_ID",
      "prompt": "the green t-shirt from image 1 and the trousers from image 2",

• Confidence: 95% confidence
• Finding: The optional reference_pose field can contain an additional image of a person, increasing the volume of personal data sent off-platform. This makes the privacy implications slightly broader, especially where pose references depict identifiable people who may not have consented to processing.

External Transmission

Medium

• Category: Data Exfiltration

Content

export PRUNA_API_KEY="your_key"

# 1) Generate photoreal plate (or upload your own)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
  -H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
  -H 'Model: p-image' \
  -d '{"input":{"prompt":"Photoreal editorial fashion photograph, woman mid-20s South Asian, seated on weathered wood floor against textured plaster wall, soft window daylight, 3:4, natural skin, single subject one frame","aspect_ratio":"3:4"}}'

• Confidence: 92% confidence
• Finding: This command sends prompt content to an external service at api.pruna.ai. While expected for an image-generation skill, it still creates a real data exfiltration path if users assume prompts are processed locally or include sensitive business or personal information in the prompt.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Complete random seed ritual (SSoT) before writing prompts — do not pass ritual string as API seed

# 2) Upload person + garment refs → /v1/files, then try-on (normal mode for finals)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
  -H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
  -H 'Model: p-image-try-on' \
  -d '{

• Confidence: 97% confidence
• Finding: This step directs users to upload person and garment reference images to an external API for virtual try-on. Because the skill's core input is a person's image, this can expose personal, identifying, or biometric-like data to a third party without any inline warning, making the transmission more dangerous than generic external API use.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H 'Model: p-image-try-on' \
  -d '{
    "input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_ID",
      "garment_images": ["https://api.pruna.ai/v1/files/GARMENT_ID"],
      "output_quality": 95,
      "preserve_input_size": true

• Confidence: 96% confidence
• Finding: The person_image field references a remotely hosted uploaded user image, confirming that a person's photo is transmitted and stored externally as part of the workflow. In the context of a virtual try-on skill, that materially raises privacy risk because the image may uniquely identify an individual and could reveal appearance, demographic, or other sensitive attributes.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{
    "input": {
      "person_image": "https://api.pruna.ai/v1/files/PERSON_ID",
      "garment_images": ["https://api.pruna.ai/v1/files/GARMENT_ID"],
      "output_quality": 95,
      "preserve_input_size": true
    }

• Confidence: 88% confidence
• Finding: The garment_images field also references external file storage and transmission to a third-party API. Although garment photos are usually less sensitive than person photos, they may still contain proprietary product imagery or embedded metadata, and the skill does not warn users about that external sharing.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.