AI Logo Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:21 AM UTC
• Version: 1.0.0

Overview

This is a coherent AI logo generator, but it needs Review because it can automatically use a stored login token, spend service credits, send logo prompts to a third-party API, and save downloaded files with weak scoping and login hardening.

Install only if you are comfortable sending logo prompts and brand details to ailogogenerator.online, storing a local bearer token, and spending service credits. Prefer explicit invocation, confirm before generation/download, keep auth.json protected, delete it to log out, and review the generated download URL/path before saving files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: README.md:10

Finding

Unpinned Third-Party Installer and Mutable Skill Source

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: login.mjs:18

Finding

OAuth Callback Accepts Uncorrelated Bearer Tokens

Content

View full analysis

{ const url = new URL(req.url, `http://${CALLBACK_HOST}`); if (url.pathname !== "/callback") { res.writeHead(404); res.end("Not found"); return; } const params = parseQuery(url.search.slice(1)); const token = params.token; const email = params.email || ""; if (!token) { res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }); res.end(ERROR_HTML("No token received from the server.")); cleanup(); console.error("Login failed: no token in callback."); process.exit(1); return; } const authData = saveAuth(token, email); ``` ### Technical Analysis The login process starts an HTTP listener on `127.0.0.1:19876` and accepts a bearer token from the callback query string. The authorization request contains only the callback URL. It does not generate or transmit a cryptographically random `state` value, and the callback does not validate request correlation. PKCE or an equivalent authorization-code binding is also absent. Binding the listener to the loopback interface limits direct remote access, but it does not authenticate callback requests. A browser page or another process operating while the listener is active may attempt to send a request to the loopback callback. If such a request supplies a token before the legitimate callback arrives, the script stores that token in the local authentication file. ### Attack Path 1. The victim starts `login.mjs`, opening the callback listener for up to 120 seconds. 2. Durin ...[truncated 1017 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: login.mjs:71

Finding

Reflected HTML Injection in Login Callback Page

Content

View full analysis

` Login successful — AI Logo Generator ...

✓

Login successful

You're now authenticated${email ? ` as ${email}` : ""}.
You can close this tab and return to your terminal.

Token saved to ~/.config/ailogogenerator.online/auth.json

`; ``` ```javascript const params = parseQuery(url.search.slice(1)); const token = params.token; const email = params.email || ""; if (!token) { res.writeHead(400, { "Content-Type": "text/html; charset=utf-8" }); res.end(ERROR_HTML("No token received from the server.")); cleanup(); console.error("Login failed: no token in callback."); process.exit(1); return; } const authData = saveAuth(token, email); res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" }); res.end(SUCCESS_HTML(email)); ``` ### Technical Analysis The `email` query parameter is attacker-controlled callback input. It is decoded and interpolated directly into an HTML response without HTML escaping or sanitization. A crafted value can terminate the existing `` and insert arbitrary markup, including script-capable content. Because the response is served by a loopback HTTP origin, exploitation requires reaching the callback listener while it is active. The missing OAuth request correlation described separately makes it easier to submit a crafted callback. ### Attack Path 1. The victim launches the login script, which starts the loopback callback server. 2. An attacker causes t ...[truncated 1004 chars]

Remediation

View remediation

`, `"`, and `'`. - Validate `email` against an appropriate length and format before storing or displaying it. - Add a restrictive Content Security Policy, such as `default-src 'none'; style-src 'unsafe-inline'`, while avoiding scripts entirely. - Add `X-Content-Type-Options: nosniff`. - Implement OAuth `state` validation and PKCE so unsolicited crafted callbacks are rejected before rendering. - Avoid returning bearer tokens in URLs because URLs can be exposed through browser history, logs, and related metadata. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.md:108

Finding

Unvalidated Server-Provided Image Download URL

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 28)May include surrounding context.

md

Replace `<SKILL_DIRECTORY>` with the actual directory where this `skill.md` lives. You can find it by checking `$CLAUDE_SKILL_DIR` or resolving the path relativ

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 127)May include surrounding context.

md

oken expired. Delete `~/.config/ailogogenerator.online/auth.json`, then re-run `login.mjs` to get a fresh token. Then retry the generation automatically.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

npx skills add qq919006380/ai-logo-generator

text

That's it. Claude Code picks up skills from `~/.claude/skills/` automatically.

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The conversational example says the skill may load automatically for a broad request like creating an icon or logo, which encourages implicit invocation without a clearly bounded trigger. Because this skill performs browser auth, network requests, token use, and file writes, overly broad activation increases the chance of unintended side effects from normal conversation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README describes opening a browser for authentication, storing a token at a fixed local path, sending prompt data to a remote API, polling the service, downloading a generated file, and writing it locally, but does not present a prominent warning about these privacy and side-effect implications. Users may disclose sensitive branding or project information, persist credentials on disk, and create local files without fully informed consent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly says the skill can be triggered by ordinary conversational requests such as asking to make a logo, even without a slash command. Overly broad auto-trigger guidance can cause the agent to invoke the skill in contexts the user did not clearly intend, increasing the chance of unexpected browser launches, network requests, authentication flows, or file writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that an authentication token is stored at ~/.config/ailogogenerator.online/auth.json but does not warn users about local credential storage, file permissions, or the consequences of token theft. If that file is readable by other local users, synced to backups, or exposed through logs or tooling, an attacker could reuse the token to access the associated account.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 4)May include surrounding context.

md

---
name: ai-logo-generator
version: 1.0.0
description: "Generate professional AI logos using ailogogenerator.online. Use this skill whenever the user wants to create a logo, brand icon, app icon, favicon, or any visual identity asset — even if they don't explicitly mention 'logo generator'. Covers requests like 'make me a logo', 'design an icon for my app', 'I need a brand mark', or 'generate a logo for my startup'."
license: MIT-0
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is overly broad and instructs activation for almost any visual identity request, including generic icon and design tasks. This can cause the agent to invoke an external stateful service unexpectedly, exposing user prompts to a third party and potentially initiating credit-consuming operations outside a clearly bounded logo-only workflow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The invocation guidance says to use the skill for any logo, icon, or brand identity generation request without defining boundaries or disallowed cases. In context, that ambiguity increases the chance of unintended tool use, third-party data disclosure, and paid API calls based on normal conversational design requests rather than explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to download the generated image and save it into the current working directory automatically, but it does not require notifying the user beforehand or obtaining consent for local file creation. Automatic filesystem writes can surprise users, overwrite nearby workflow expectations, and create unwanted artifacts on the host environment, especially when triggered from a broadly activated skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The workflow states that the skill downloads imageUrl and saves the result to ./logo-*.png, but the description does not clearly warn that files will be written into the current working directory. Although the example shows a saved path, it lacks an explicit caution about local file creation and potential overwrites or workspace effects.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: login.mjs:48