ImageFlare

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:30 PM UTC
• Version: 1.0.1

Overview

This image-generation skill is purpose-aligned, but it needs review because it installs an unpinned external CLI that handles a Cloudflare API token.

Install only if you are comfortable using the imageflare PyPI CLI with your Cloudflare account. Prefer the interactive config flow, use a narrowly scoped Cloudflare API token, avoid pasting real tokens into command lines or shared transcripts, and consider pinning or reviewing the package before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party CLI Dependency Installed from PyPI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-20
Vulnerability Type: Unpinned external package dependency
Risk Level: Medium

Vulnerable Code

yaml

"install":
  [
    {
      "id": "pip",
      "kind": "pip",
      "package": "imageflare",
      "bins": ["imageflare"],
      "label": "Install imageflare (pip)",
    },
  ],

Technical Analysis

The skill installs the third-party imageflare package from PyPI without specifying an exact version or package integrity hash. Consequently, installation resolves whichever compatible release is available at that time rather than a version whose contents were reviewed alongside this skill.

The project contains only SKILL.md; it does not include the CLI implementation. The audit therefore cannot verify the installed package's setup behavior, credential storage, network destinations, image handling, or runtime commands. Because Python package installation and subsequent CLI execution can run code with the user's permissions, a compromised publisher account, malicious future release, or upstream supply-chain compromise could introduce arbitrary code after this skill has been reviewed.

This finding does not establish that the current imageflare package is malicious. The vulnerability is the absence of version and integrity controls over executable third-party code.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or its release process.
2. The attacker publishes a malicious release under the expected imageflare package name.
3. A user installs the skill dependency through the unpinned package declaration.
4. The package manager resolves and installs the malicious release.
5. Malicious installation hooks or CLI runtime code execute with the installing user's permissions.
6. That code may access files available to the user, including the documented ImageFlare configuration and Cloudfl ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version, such as imageflare==X.Y.Z.
2. Require a cryptographic hash for the approved distribution by using a hash-locked requirements file or an equivalent verified artifact mechanism.
3. Maintain a lock file or controlled internal package mirror so installation remains reproducible.
4. Verify the package publisher, source repository, release provenance, and correspondence between source and published artifacts.
5. Review installation hooks and runtime code before approving upgrades.
6. Perform upgrades through an explicit review process rather than automatically accepting the latest release.
7. Use a narrowly scoped Cloudflare API token and avoid granting permissions beyond those required for Workers AI.
8. Run the CLI in an isolated environment with only the files and credentials necessary for the requested image operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill explicitly shows a non-interactive command that passes the Cloudflare API token on the command line (imageflare config set --account-id YOUR_ID --api-token YOUR_TOKEN) without warning about secret-handling risks. Command-line secrets can be exposed through shell history, process listings, terminal logs, or agent transcripts, which is especially relevant in an agent skill that users may copy verbatim.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.