ClawHub
Back to skill

Security audit

PixelLab Pip

Security checks for vulnerabilities and agentic risk

Overview

This PixelLab assistant skill is broad and powerful, but its file, shell, credential, paid-call, and remote-action behavior is disclosed, purpose-aligned, and guarded by user approval rules.

Install only if you want an agent to operate PixelLab through MCP/REST, write generated assets and reports locally, and potentially spend PixelLab generations after approval. Keep auto off unless you are comfortable skipping future cost prompts, and do not paste PixelLab secrets into chat.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (62)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code chunk only supports the narrow 'bark completion sounds' aspect of the description. It manages a pixellab-pip.json config, toggles 'bark' and 'auto' flags, validates a WAV file, and plays it via platform-specific local audio commands or winsound. The declared purpose, however, presents the skill as a comprehensive PixelLab operational and creative workflow tool spanning setup, authentication, routing, generation, editing, animation, troubleshooting, and cost inquiries. Since the actual code's primary behavior is materially different and much narrower than the declared description, this is a description-behavior mismatch. The declared permissions are not themselves problematic here, but the functional scope is overstated relative to the supplied code.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
ces/update.md`, for uninstall read `references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
ces/update.md`, for uninstall read `references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md
ces/update.md`, for uninstall read `references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.

md
ces/update.md`, for uninstall read `references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.

md
references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md
references/uninstall.md`, for bark read `references/bark.md`, for auto read `references/auto.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
ible. | `portrait-character-pro` (Pro image conversion). Supplied-image roles: `references/image-input-roles.md`. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
ible. | `portrait-character-pro` (Pro image conversion). Supplied-image roles: `references/image-input-roles.md`. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md
ible. | `portrait-character-pro` (Pro image conversion). Supplied-image roles: `references/image-input-roles.md`. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
ible. | `portrait-character-pro` (Pro image conversion). Supplied-image roles: `references/image-input-roles.md`. |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

md
very `references/` path against this skill's own directory (the parent of this `SKILL.md`) and use an absolute path in the tool call. If that directory is unkno

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
very `references/` path against this skill's own directory (the parent of this `SKILL.md`) and use an absolute path in the tool call. If that directory is unkno

MCP Config Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · references/setup.md (reported line 57)May include surrounding context.

  • Antigravity IDE: Agent panel ... → MCP Servers → Manage MCP Servers → View raw config.

    • Antigravity CLI: /mcp for status, reload, and logs; use its mcp_config.json for manual server definitions.

    Use Antigravity's global mcp_config.json opened through its UI, or workspace .agents/mcp_config.json when the user explicitly wants project scope. Remote servers require serverUrl — never use legacy url or httpUrl. Token-free preview (display only; <PIXELLAB_SECRET> is a placeholder, not documented environment-variable interpolation):

    json
    {

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
7. Prepare natural-language parameters per Text Preparation. For non-English or mixed-language requests, read `references/localization.md`.
8. For animation, preserve the user's requested frame count; otherwise use the endpoint or template default. Exception: preset/template character animations take no `frame_count`; pick a matching template id such as `walking-8-frames` (catalog in `references/preset-skeleton-template-animation.md`) or fall back to v3 custom mode. Preserve PixelLab's returned frame order; no ping-pong, reversed, duplicated, or trimmed outputs unless the user asks for that playback style.
9. If the user says cheap, budget, low-cost, fewer credits, or similar, read `references/cost-routing.md` before choosing a paid route, and ask before each extra paid attempt unless a concrete budget or attempt count was approved.
10. Before live generation, confirm the PixelLab bearer token is configured without asking the user to paste it into chat (see Auth And Execution).
11. `seed`: omit by default; PixelLab randomizes it. Send it in two cases only — the user gave a seed (send verbatim), or two or more calls share near-identical wording and should attempt to hold the same composition (seed-lock, not a guarantee): generate one random positive integer (`0` means random, so never 0) and send that same value on every call in the set. Never ask the user for a seed.
12. Act or answer. Once the job's live generation(s) have returned image(s) — after the last one in a chain — do three follow-ups before the final report, even if the user did not ask: the completion sound (`references/bark.md`), the manifest (`references/usage-reporting.md`), and the `*.blueprint.json` (`references/blueprint.md`). Then send one final report. Ask a short clarification only for known collisions. Before that report, send only a blocker or a question you need answered — never progress, status, findings, or intentions; those belong in the final report. For a pending job, keep polling its ge
...[truncated 26 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/blueprint.md (reported line 125)May include surrounding context.

md
7. Prepare natural-language parameters per Text Preparation. For non-English or mixed-language requests, read `references/localization.md`.
8. For animation, preserve the user's requested frame count; otherwise use the endpoint or template default. Exception: preset/template character animations take no `frame_count`; pick a matching template id such as `walking-8-frames` (catalog in `references/preset-skeleton-template-animation.md`) or fall back to v3 custom mode. Preserve PixelLab's returned frame order; no ping-pong, reversed, duplicated, or trimmed outputs unless the user asks for that playback style.
9. If the user says cheap, budget, low-cost, fewer credits, or similar, read `references/cost-routing.md` before choosing a paid route, and ask before each extra paid attempt unless a concrete budget or attempt count was approved.
10. Before live generation, confirm the PixelLab bearer token is configured without asking the user to paste it into chat (see Auth And Execution).
11. `seed`: omit by default; PixelLab randomizes it. Send it in two cases only — the user gave a seed (send verbatim), or two or more calls share near-identical wording and should attempt to hold the same composition (seed-lock, not a guarantee): generate one random positive integer (`0` means random, so never 0) and send that same value on every call in the set. Never ask the user for a seed.
12. Act or answer. Once the job's live generation(s) have returned image(s) — after the last one in a chain — do three follow-ups before the final report, even if the user did not ask: the completion sound (`references/bark.md`), the manifest (`references/usage-reporting.md`), and the `*.blueprint.json` (`references/blueprint.md`). Then send one final report. Ask a short clarification only for known collisions. Before that report, send only a blocker or a question you need answered — never progress, status, findings, or intentions; those belong in the final report. For a pending job, keep polling its ge
...[truncated 26 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md
- Every pixel of requested art must originate from PixelLab or the user. Local tools may read, download, assemble, package, import/export, preview, verify, mask, pad, crop, resize, and format-convert those pixels. Locally authored generation controls such as masks, palette swatches/`color_image`, reference guides, and shape templates are allowed as inputs; report them as inputs. Do not draw, repaint, or synthesize requested content locally unless the user explicitly approves a labeled non-PixelLab fallback.
- Reviewable static candidates: when a static image-style MCP tool or REST endpoint returns multiple alternatives, read `references/reviewable-candidates.md` before selecting, saving, or continuing from one.
- Do not bake a colored, checkerboard, white, black, green-screen, or matte background into transparent frames, final GIFs, spritesheets, previews, or report images unless the user explicitly asks for it. A checkerboard is allowed only as a clearly labeled inspection aid kept separate from final deliverables.
- Do not post-process PixelLab output into a claimed final asset without explicit approval. Local crop/split/format work that preserves original pixels is allowed when reported honestly; resizing, reassembling, compositing, or repairing failed outputs locally must not be called final without approval. Exception: when a request used `no_background: true` but the output kept a background, read `references/background-removal.md` and attempt safe removal when verification shows the background is removable without changing the art.
- Save downloaded generations, derived previews, manifests, and packages in a named per-generation subfolder under the `pixellab-pip-generations/` folder at the user's project/workspace root — not loose in its root, and never resolved against a background or detached process's working directory, which may default to the home folder — unless the user names another location. A returned base64 image may be raw RGBA rather than PNG; co
...[truncated 26 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md
| Surface | Use for | Avoid |
|---|---|---|
| Hosted MCP | Managed PixelLab assets with IDs, polling, downloads, list/get/delete helpers, talking-portrait/lip-sync tools, and map/project/sandbox/agent helpers, including `create_ui_asset`, `create_font`, or `create_portrait_character` when visible; also raw-image primitives `create_image_pixflux`/`create_image_pixen`/`create_image_pro`/`get_image`, `edit_image`, `edit_image_pixen`, `inpaint_image`, `animate_image`, `animate_image_pixminimax`, `animate_with_skeleton_v3`, `image_to_pixelart`, and the cleanup tools `unzoom_image`/`correct_pixelart`/`reduce_colors` when visible — these need no managed asset. PixelArt Workbench uses its own command workflow; read `references/pixelart-workbench.md` for supported inputs. Explicit Pro Flash requests have separate tools; read `references/pro-flash.md`. | REST-only controls such as multi-image style reference (`generate-with-style-v2`), freeform UI (`generate-ui-v2`), image-to-text, stateless lip sync, Pro image-to-pixel-art, or packed spritesheet/ZIP export; resize and remove-background (no MCP tool); or any MCP call when PixelLab MCP tools are not visible. |
| REST v2 | Scripts, batch jobs, server integrations, exact endpoint control, and REST-only capabilities such as multi-image style reference, freeform UI, base-tier edit/inpaint controls, one-pose skeleton estimation, legacy three-frame skeleton animation, image-to-text, and route-specific enhancement fields that the visible MCP tool lacks (see the Intent Router for exact routes) — plus any of the MCP-covered work below when MCP tools are not visible. | Guessing SDK methods without checking the installed SDK or current docs. |
| Website / Map Workshop / Game Builder | Human product surfaces, the Creator queue, Game Builder (Tier 1+), full-map manual work, Godot/Unity map export, rich libraries, visible browser assistance. | Programmatic use of copied browser session tokens or undocumented internal endpoints used by first
...[truncated 25 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/setup.md (reported line 130)May include surrounding context.

md
| Surface | Use for | Avoid |
|---|---|---|
| Hosted MCP | Managed PixelLab assets with IDs, polling, downloads, list/get/delete helpers, talking-portrait/lip-sync tools, and map/project/sandbox/agent helpers, including `create_ui_asset`, `create_font`, or `create_portrait_character` when visible; also raw-image primitives `create_image_pixflux`/`create_image_pixen`/`create_image_pro`/`get_image`, `edit_image`, `edit_image_pixen`, `inpaint_image`, `animate_image`, `animate_image_pixminimax`, `animate_with_skeleton_v3`, `image_to_pixelart`, and the cleanup tools `unzoom_image`/`correct_pixelart`/`reduce_colors` when visible — these need no managed asset. PixelArt Workbench uses its own command workflow; read `references/pixelart-workbench.md` for supported inputs. Explicit Pro Flash requests have separate tools; read `references/pro-flash.md`. | REST-only controls such as multi-image style reference (`generate-with-style-v2`), freeform UI (`generate-ui-v2`), image-to-text, stateless lip sync, Pro image-to-pixel-art, or packed spritesheet/ZIP export; resize and remove-background (no MCP tool); or any MCP call when PixelLab MCP tools are not visible. |
| REST v2 | Scripts, batch jobs, server integrations, exact endpoint control, and REST-only capabilities such as multi-image style reference, freeform UI, base-tier edit/inpaint controls, one-pose skeleton estimation, legacy three-frame skeleton animation, image-to-text, and route-specific enhancement fields that the visible MCP tool lacks (see the Intent Router for exact routes) — plus any of the MCP-covered work below when MCP tools are not visible. | Guessing SDK methods without checking the installed SDK or current docs. |
| Website / Map Workshop / Game Builder | Human product surfaces, the Creator queue, Game Builder (Tier 1+), full-map manual work, Godot/Unity map export, rich libraries, visible browser assistance. | Programmatic use of copied browser session tokens or undocumented internal endpoints used by first
...[truncated 25 chars]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 211)May include surrounding context.

md
- No local code or editor automation to create or alter requested visual content: no PIL/Pillow drawing, canvas/SVG drawing, ImageMagick draw, Aseprite Lua drawing, ASCII-to-image, or procedural pixel placement. Local code may copy, mask, composite, and verify pixels that came from PixelLab or the user.
- No undocumented internal endpoints used by first-party surfaces: root website routes, unversioned `https://api.pixellab.ai/` paths like `/tilesets/create`, or Aseprite extension operation URLs. Treat them as unsupported unless they appear in public REST v2 docs/OpenAPI or MCP docs.
- Never ask users to paste the PixelLab bearer token into chat; direct them to the setup wizard, local `PIXELLAB_SECRET`, or app secret settings.
- Never scrape browser session tokens or cookies. Website session tokens are not API bearer tokens; never use one for the other.
- Do not default to v1 or old SDK README examples for new work, and do not assume an installed SDK covers every current v2 endpoint — confirm the installed package or call REST v2 directly.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · assets/bark.py (reported line 177)May include surrounding context.

python
if shutil.which(command[0]) is None:
            continue
        try:
            completed = subprocess.run(
                command,
                stdout=subprocess.DEVNULL,
                stderr=subprocess.DEVNULL,

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/auto.md (reported line 31)May include surrounding context.

}

text

The helper writes `auto` to `pixellab-pip.json` beside `SKILL.md` atomically, preserving the other key (notably `bark`). Do not hand-edit the JSON — the read-modify-write is what a short-turn agent corrupts (misreading the current value flips the toggle backwards). If Python is unavailable, hand-write `auto` as a boolean in that file, preserving `bark`; if the skill directory is read-only, write instead to `pixellab-pip/pixellab-pip.json` inside the OS user-config dir (`%APPDATA%` on Windows, `~/Library/Application Support` on macOS, `${XDG_CONFIG_HOME:-~/.config}` on Linux) — where the helper also reads it. Do not scan other config, home, shell, credential, or project directories for it. Do not rewrite config except when the user runs an explicit `auto` command. If persistence fails everywhere, say the setting could not be saved and do not claim it changed.

## The cost-approval gate

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/bark.md (reported line 33)May include surrounding context.

}

text

The helper writes `bark` to `pixellab-pip.json` beside `SKILL.md` atomically, preserving the other key (notably `auto`). Do not hand-edit the JSON — the read-modify-write is what a short-turn agent corrupts (misreading the current value flips the toggle backwards). If Python is unavailable, hand-write `bark` as a boolean in that file, preserving `auto`; if the skill directory is read-only, write instead to `pixellab-pip/pixellab-pip.json` inside the OS user-config dir (`%APPDATA%` on Windows, `~/Library/Application Support` on macOS, `${XDG_CONFIG_HOME:-~/.config}` on Linux) — where the helper also reads it. Do not scan other config, home, shell, credential, or project directories for it. Do not rewrite config except when the user runs an explicit `bark` command. If persistence fails everywhere, say the setting could not be saved and do not claim it changed.

## When To Play

Static analysis

No suspicious patterns detected.