grounding-anything

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:54 AM UTC
• Version: 1.0.0

Overview

This image-grounding skill does what it claims, but it directs agents to send images to a hardcoded internal HTTP service while bypassing proxies, which users should review before installing.

Install only if you trust the configured internal model service and are comfortable sending image contents and prompts to it over the documented path. Avoid using it with sensitive screenshots or documents unless the endpoint, transport security, logging, and retention policy are known; also check where annotated output files are saved and clean them up when needed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27

Finding

Plaintext Image Transmission with Proxy Bypass to a Hardcoded Internal Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–33 and 67–79
Vulnerability Type: Insecure transport and security-control bypass
Risk Level: Medium

Vulnerable Code

python

os.environ['NO_PROXY'] = '172.20.112.202'
os.environ['no_proxy'] = '172.20.112.202'

url = 'http://172.20.112.202:5002/v1/chat/completions'
img = '/path/to/image.jpg'

The subsequent API request supplies the local image to that endpoint:

python

response = HttpInterface(
    url,
    images=[img],
    no_think=True,
)

Technical Analysis

The Skill directs the Agent to upload user-supplied images to a hardcoded private-network service using plaintext HTTP. Because HTTP does not provide transport encryption or server authentication, a party capable of observing or controlling the network path could inspect or modify image uploads and model responses.

The Skill also sets both NO_PROXY and no_proxy for the destination. This forces the request to bypass configured proxies that may otherwise provide TLS termination, traffic inspection, access control, audit logging, or data-loss-prevention enforcement. The endpoint is not made configurable or validated against an approved allowlist, and the instructions do not require explicit user approval before image contents are transmitted.

The reviewed project contains only SKILL.md; the referenced HttpInterface implementation is not included. Therefore, additional authentication, validation, logging, and transport behavior inside that dependency could not be verified.

Attack Path

1. A user invokes the grounding Skill with an image containing sensitive information, such as a screenshot, document, personal data, or internal interface.
2. The Agent follows the Skill instructions and sets NO_PROXY and no_proxy for 172.20.112.202.
3. The Agent submits the image to http://172.20.112.202:5002/v1/chat/completions.
4. A compromised destination ...[truncated 1041 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the plaintext endpoint with an authenticated HTTPS endpoint and require certificate verification. Do not permit silent fallback to HTTP.
2. Remove the hardcoded IP address. Load the endpoint from a trusted configuration source and validate it against an explicit allowlist of approved hosts and schemes.
3. Avoid globally modifying NO_PROXY or no_proxy. If direct connectivity is operationally required, scope proxy behavior to the individual request and document why bypassing organizational controls is necessary.
4. Require explicit user approval before transmitting an image to a remote or internal model service, especially when the image may contain sensitive data.
5. Clearly document the service owner, authentication requirements, data retention policy, logging behavior, and permitted data classifications.
6. Add destination authentication, request authorization, timeouts, response-size limits, and robust error handling to the HTTP client.
7. Validate returned coordinates before visualization, including numeric type checks, coordinate ordering, range enforcement, and limits on the number of returned boxes.
8. Include the implementations of HttpInterface and the referenced box-processing utilities in the auditable package, or pin them to reviewed and integrity-verified dependencies.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly sends user prompts and image data to a model API over plain HTTP, but does not warn users that their content is transmitted off-process and without transport encryption. This can expose sensitive images, extracted text, or prompts to interception on the network and creates a transparency/privacy issue even on an internal network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The workflow states that it saves a rendered output image to disk, but does not disclose that persistent files will be created. This can leave sensitive visual data or annotations on the filesystem unexpectedly, especially if the image contains private information or if the host is shared.

Content

No source excerpt is available for this finding.