Picrd Image Hosting

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:32 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward helper for uploading user-selected images to picrd.com, but users should treat uploads as public and potentially permanent.

Install if you want an agent to upload selected images to picrd.com. Do not use it for private screenshots, documents, credentials, or non-image files; prefer temporary TTL uploads when appropriate and save the delete URL immediately if you may need removal.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest description includes broad trigger phrases like 'free hosting', 'file hosting', and 'file share' even though the skill only handles public image uploads to a specific service. This can cause the skill to be invoked for generic hosting or file-sharing requests outside its intended scope, increasing the chance that an agent routes unrelated or sensitive user files to an unauthenticated third-party image host.

VirusTotal

65/65 vendors flagged this skill as clean.