Security audit
Security checks for vulnerabilities and agentic risk
The skill is a coherent virtual try-on guide that clearly uses Pruna's remote API, with manageable cautions around personal image uploads and unpinned optional skill installs.
Install only from a Pruna source you trust, consider pinning or verifying any `npx skills add` targets before use, and upload only person, garment, or pose images you are authorized to send to Pruna's remote API. Review Pruna's privacy and retention terms before processing identifiable or sensitive photos.
The skill instructs users to install and execute npx skills packages without pinning an exact immutable version or commit, which creates a supply-chain risk. If the referenced package or a dependency is updated maliciously or compromised, agents may fetch and run unreviewed code during installation.
This line references npx skills without an exact pinned version, allowing future package changes to alter what code is executed. In an agent skill ecosystem, that exposes users to dependency hijacking or malicious package updates.
Unpinned npx skills installation means the executed package content can change over time without any change to this skill file. That is a classic software supply-chain exposure and is especially relevant where agents may automatically follow setup instructions.
The full-suite install command also uses an unpinned npx skills reference, expanding the blast radius because it may pull multiple packages transitively. A compromise upstream could result in arbitrary code execution at install time.
This alternate-skill installation command again relies on an unpinned npx skills package reference. Because it is presented as a normal workflow branch, users may execute code from a moving target without realizing the risk.
The skill recommends another unpinned package install command, preserving the same supply-chain weakness. If that dependency path is compromised, the agent or operator could execute attacker-controlled code.
The skill explicitly instructs users to upload person photos, garment photos, and optional pose references to a remote API, but it does not provide an explicit privacy/data-handling warning or consent guidance. Because the data includes potentially sensitive biometric and personal images, omission of disclosure increases the risk of unsafe handling and uninformed transmission.
This command uploads a local person image to an external service using an API key. The transmission itself is expected for the skill's purpose, but it is still a genuine data-exfiltration boundary that can expose personal images if users are not properly informed or if the workflow is used on sensitive content.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/person.jpg"
This command uploads a local person image to an external service using an API key. The transmission itself is expected for the skill's purpose, but it is still a genuine data-exfiltration boundary that can expose personal images if users are not properly informed or if the workflow is used on sensitive content.
curl -X POST "https://api.pruna.ai/v1/files" \
-H "apikey: ${PRUNA_API_KEY}" \
-F "content=@/path/to/person.jpg"
This command uploads a garment image to a third-party API, which is an external transmission of user-provided content. While garment photos are often less sensitive than person photos, they can still be proprietary or confidential in ecommerce/fashion contexts.
-H "apikey: ${PRUNA_API_KEY}"
-F "content=@/path/to/person.jpg"
curl -X POST "https://api.pruna.ai/v1/files"
-H "apikey: ${PRUNA_API_KEY}"
-F "content=@/path/to/garment.png"
This prediction request sends user-controlled image URLs and job parameters to an external API for processing. That is functionally necessary for the skill, but it creates a clear data transfer and third-party processing boundary that should be treated as a security-relevant exposure.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image-try-on' \
The synchronous prediction request transmits image references and processing parameters to a remote service just like the async form. The sync mode does not change the underlying exposure: user images are still sent for third-party processing.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image-try-on' \
The extended input example sends multiple uploaded images, an optional pose reference, and a textual prompt to an external service. Because the data can include personal images and pose references, the privacy and third-party processing concerns are even broader in this variant.
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' \
-H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image-try-on' \
The optional reference_pose field introduces another image upload/reference that may contain a person's likeness and body pose, increasing privacy sensitivity. Sending such references to a third party without explicit handling guidance can expose personal data beyond the base try-on images.
"person_image": "https://api.pruna.ai/v1/files/PERSON_FILE_ID",
"garment_images": [
"https://api.pruna.ai/v1/files/MULTI_GARMENT_SHOT_ID",
"https://api.pruna.ai/v1/files/BOTTOM_ID"
],
"reference_pose": "https://api.pruna.ai/v1/files/POSE_REF_ID",
"prompt": "the green t-shirt from image 1 and the trousers from image 2",
This follow-on skill installation command references npx skills without version pinning, which is a repeatable supply-chain risk. Chained skills increase exposure because users may install multiple moving packages from the same instructions.
The documentation encourages installation of an unpinned package, so the retrieved code can differ between executions and over time. That undermines reproducibility and increases the chance of malicious dependency substitution.
Another unpinned npx skills command appears in the skill's next-step guidance. Because these are likely to be copy-pasted by users or agents, they materially increase practical exploitability of a compromised package.
This line repeats the same supply-chain pattern: mutable package retrieval via npx with no exact version. In agent contexts, installation instructions embedded in skills can be followed automatically, making the risk more operationally significant.
The final follow-on install instruction is also unpinned, leaving users exposed to compromised future package contents. The repeated pattern throughout the file suggests weak supply-chain hygiene rather than an isolated mistake.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export PRUNA_API_KEY="your_key"
The example explicitly instructs users to upload person and garment reference images to a remote API, but it does not disclose privacy, consent, retention, or handling considerations for those images. Because person photos are often personal or biometric in nature, omitting a warning can lead users to transmit sensitive data to a third-party service without informed consent or appropriate safeguards.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export PRUNA_API_KEY="your_key"
# 1) Generate photoreal plate (or upload your own)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{"input":{"prompt":"Photoreal editorial fashion photograph, woman mid-20s South Asian, seated on weathered wood floor against textured plaster wall, soft window daylight, 3:4, natural skin, single subject one frame","aspect_ratio":"3:4"}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export PRUNA_API_KEY="your_key"
# 1) Generate photoreal plate (or upload your own)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{"input":{"prompt":"Photoreal editorial fashion photograph, woman mid-20s South Asian, seated on weathered wood floor against textured plaster wall, soft window daylight, 3:4, natural skin, single subject one frame","aspect_ratio":"3:4"}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export PRUNA_API_KEY="your_key"
# 1) Generate photoreal plate (or upload your own)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{"input":{"prompt":"Photoreal editorial fashion photograph, woman mid-20s South Asian, seated on weathered wood floor against textured plaster wall, soft window daylight, 3:4, natural skin, single subject one frame","aspect_ratio":"3:4"}}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
export PRUNA_API_KEY="your_key"
# 1) Generate photoreal plate (or upload your own)
curl -X POST 'https://api.pruna.ai/v1/predictions' \
-H 'Content-Type: application/json' -H "apikey: ${PRUNA_API_KEY}" \
-H 'Model: p-image' \
-d '{"input":{"prompt":"Photoreal editorial fashion photograph, woman mid-20s South Asian, seated on weathered wood floor against textured plaster wall, soft window daylight, 3:4, natural skin, single subject one frame","aspect_ratio":"3:4"}}'
No suspicious patterns detected.