Security audit

Picwish Skills

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent PicWish image-processing integration, but it needs review because it uploads potentially sensitive images to a third party and tells agents to expose temporary authenticated result links.

Install only if users understand that images and supplied image URLs/files are sent to PicWish for remote processing. Avoid sensitive faces, IDs, private documents, and confidential screenshots unless authorized, do not set PICWISH_BASE_URL except to a trusted PicWish endpoint, and treat returned full result URLs as sensitive temporary links that should not be shared or logged unnecessarily.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The code allows the API base URL to be overridden via the PICWISH_BASE_URL environment variable with no validation of host or scheme. Because subsequent requests attach the X-API-KEY header and may upload image/form data, a malicious or compromised runtime environment can redirect traffic to an arbitrary server and exfiltrate credentials and user content.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README describes image-processing features built on the PicWish API but does not clearly warn users that submitted images may be transmitted to and processed by a third-party service. This can cause users to unknowingly upload sensitive photos, IDs, or documents, creating privacy, compliance, and data-handling risks, especially given the skill set includes ID photo generation and OCR.

Natural-Language Policy Violations

High

Confidence: 98% confidence
Finding: The skill explicitly instructs the agent to display complete mask URLs and warns not to strip query parameters because they contain authentication tokens. Exposing bearer-style or signed URLs in chat or logs can leak access to generated assets to unintended parties and may allow replay within the token validity window.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly sends user-supplied images to an external AI colorization service, but the description does not clearly warn users that their images leave the local environment. This creates a privacy and consent issue, especially for sensitive personal photos, because users may reasonably assume a local-only transformation unless told otherwise.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill sends user-supplied images to an external PicWish service but does not require an explicit user warning or consent step before transmission. This can expose potentially sensitive image contents to a third party unexpectedly, which is especially risky for personal photos, IDs, documents, or confidential screenshots.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill is explicitly designed to send user-supplied images to PicWish, an external third-party API, but the instructions do not require an explicit disclosure or confirmation before upload. This creates a privacy and data-handling risk, especially for facial images, because users may not realize their content is leaving the local environment and being processed by a remote service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill description tells the agent to process user images via PicWish but does not clearly warn that the image will be uploaded to an external third-party service. This creates a real privacy and consent issue, especially because users may provide sensitive photos, IDs, or proprietary images without realizing they are leaving the local environment.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill description omits a clear warning that user images are transmitted to a third-party service and that returned URLs contain authentication tokens. This creates a real data-handling risk: users may unknowingly disclose sensitive images externally, and downstream logging or sharing of the full result URL can leak bearer-style access embedded in query parameters.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill description says images are processed by PicWish and requires an API key, but it does not clearly warn the end user that their uploaded image or supplied URL will be transmitted to a third-party external service. This creates a privacy and consent issue, especially for potentially sensitive images, because users may reasonably assume local processing unless disclosure is explicit.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The instruction to reveal full authenticated mask URLs causes credential material embedded in query strings to be disclosed to the user and persisted in conversation history. Even if the URLs expire after about an hour, they can still be reused during that window by anyone with transcript access.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/lib/client.mjs:14