gpt-4o-image

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.2.9

Overview

This skill is a coherent RunAPI image-generation helper, with the main caveat that it installs an unpinned third-party CLI.

Before installing, consider whether you trust the RunAPI Homebrew tap and CLI because the skill does not pin or verify the installed version. Use a scoped RunAPI API key where possible, avoid running the CLI with elevated privileges, and only provide local media files you intend to upload to RunAPI.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned CLI Installation from a Third-Party Homebrew Tap

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–17
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill requires installation of the runapi executable from the external runapi-ai/tap Homebrew tap without specifying a version, immutable commit, expected checksum, or signature-verification procedure. Consequently, the installed executable depends on the mutable formula and artifacts served by the third-party source at installation time.

If the tap repository, package release infrastructure, artifact hosting, or publisher account is compromised, an attacker could replace the expected CLI with a malicious executable. The substituted CLI would subsequently be invoked by the skill for authentication, request submission, local file processing, and result retrieval.

This is a supply-chain weakness rather than evidence that the current package is malicious. The risk arises because the instructions do not provide controls that allow an agent or user to verify that the installed executable is the version that was reviewed.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its publisher account, or the referenced release infrastructure.
2. The attacker modifies the formula or downloadable artifact so that it installs a malicious runapi executable.
3. A user or agent follows the skill metadata and installs runapi-ai/tap/runapi.
4. Homebrew retrieves and installs the attacker-controlled dependency because the skill does not require an audited version or independent integrity check.
5. The skill invokes the compromised executable for operations such as runapi auth status, runapi auth import-token, task submission, or local media upload.
6. The executable runs with the privileges of the invoking user and can access ...[truncated 860 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the CLI to a specific, reviewed release rather than relying on an implicitly mutable latest version.
• Require verification of the downloaded artifact using a publisher-provided cryptographic signature or a documented SHA-256 checksum obtained through a trusted channel.
• Pin or otherwise verify the Homebrew tap revision so changes to the formula can be reviewed before installation.
• Document the authoritative repository, release page, signing identity, and expected artifact provenance.
• Avoid automatic installation when the dependency's provenance or integrity cannot be established; stop and ask the user to install a verified release instead.
• Execute the CLI without administrator privileges and restrict its access to credentials and local files to the minimum necessary for the requested operation.
• In production environments, use a lockfile or similarly reproducible dependency mechanism and incorporate dependency provenance and integrity validation into CI.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep