z-image

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:44 AM UTC
• Version: 0.2.9

Overview

This skill coherently uses RunAPI to generate or edit images, with expected network, API-key, local-file, and output-file handling disclosed in the artifact.

Install only if you are comfortable using RunAPI for image generation/editing. Treat prompts, input images, local media paths, and API credentials as data that may be sent to RunAPI, and prefer a trusted/pinned CLI install where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13–18
Vulnerability Type: Unpinned executable dependency from a mutable third-party Homebrew tap
Risk Level: Medium

Vulnerable Code:

yaml

install:
- kind: brew
  formula: runapi-ai/tap/runapi
  bins:
  - runapi

Technical Analysis

The skill instructs the environment to install the runapi executable from the third-party Homebrew tap runapi-ai/tap/runapi. It does not pin an audited package version or immutable source revision, nor does it require verification of a checksum or publisher signature.

Consequently, the installed executable is determined by the mutable state of the external tap and its release infrastructure at installation time. The rest of the skill trusts this executable to access authentication state, process local media paths, submit potentially billable API tasks, and download outputs.

This creates a supply-chain boundary in which compromise of the tap, formula, release artifact, distribution infrastructure, or publisher account could substitute attacker-controlled executable code.

Attack Path

1. An attacker compromises the referenced Homebrew tap, its publisher account, formula repository, or associated release infrastructure.
2. The attacker modifies the formula or referenced artifact so that it installs a malicious runapi executable.
3. An agent follows the skill metadata and installs runapi-ai/tap/runapi without validating an immutable version, checksum, or signature.
4. The substituted executable runs during installation or when the documented runapi commands are invoked.
5. The executable can access data available to the invoking user, including environment-based API credentials, saved CLI authentication, request files, and local media passed to it.
6. It may exfiltrate data, manipulate API requests or results, or perform other actions within the invoking user's operating-system privileges.

...[truncated 784 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a reviewed, explicit version rather than accepting the current release from the tap.
2. Pin the formula or source to an immutable commit or content-addressed artifact where the installation mechanism supports it.
3. Publish and verify a cryptographic checksum, such as SHA-256, for the expected release artifact before execution.
4. Prefer verifiable publisher signatures and document the trusted signing identity and verification procedure.
5. Document the expected download origin and reject artifacts obtained from unexpected hosts or redirects.
6. Avoid automatic installation when the selected version and artifact integrity cannot be established.
7. Run the CLI with least privilege and expose only the credentials and local files required for the specific operation.
8. Periodically review the pinned dependency and deliberately update the pin only after validating the new release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs the agent to perform external network requests and write multiple local files (auth.json, contract.md, request.json, task.json, result.json, and downloaded media) without an explicit user-facing warning or confirmation step. While these actions are consistent with the skill’s purpose, they can still cause unintended data transfer to third-party services and filesystem side effects, especially if the agent includes sensitive local file paths or downloads untrusted content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.