Image Handoff

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

This image-routing skill is not malicious, but it should be reviewed because it shares remembered preferences and stores full image request history without clear user controls.

Install only if you are comfortable with image prompts, feedback, and remembered style preferences being shared with the artist agent and retained in memory. A safer version would send only the current prompt by default, make preference sharing opt-in, and limit or redact stored request history.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:22

Finding

Unnecessary Persistent-Memory Access and Cross-Agent Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-27
Vulnerability Type: Excessive data access and cross-agent disclosure
Risk Level: Medium

Vulnerable Code

markdown

When explicit trigger or confirmed auto-detect:
1. Extract the prompt (everything after trigger word, or the full request)
2. Send to artist agent via `sessions_send` with context:
   - Original prompt
   - Any style preferences from memory
   - Request ID for tracking

Technical Analysis

The skill instructs the agent to retrieve style preferences from persistent memory and transmit them to another agent through sessions_send. The current image prompt is necessary for image generation, but historical memory is not essential to the core handoff operation.

No instruction limits which memory records may be accessed, requires user consent, filters sensitive information, validates that preferences belong to the current user, or establishes the receiving agent's trust boundary. This violates least-privilege and data-minimization principles. A broadly interpreted “style preferences from memory” operation could disclose unrelated, stale, incorrectly attributed, or sensitive information.

Attack Path

1. A user submits an explicit or confirmed image-generation request.
2. The skill activates its handoff protocol.
3. The agent searches persistent memory for style preferences without obtaining specific consent.
4. Retrieved memory content is added to the handoff request.
5. sessions_send transfers the prompt and memory-derived information to the artist agent.
6. The receiving agent can process, retain, expose, or incorporate that information into its response.

Exploitation requires relevant information to exist in accessible memory and the artist agent to represent a separate trust or data-processing boundary.

Impact Assessment

The skill gains read access to persistent user context beyond what is strictly ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

• Forward only the current image prompt by default.
• Require explicit, informed user consent before reading or sharing persistent preferences.
• Restrict retrieval to an allowlist of dedicated, non-sensitive image-style fields.
• Do not perform broad searches across general-purpose memory.
• Validate that retrieved preferences belong to the current user and remain applicable.
• Clearly identify whether the artist agent is local, remote, or operated by a third party.
• Apply data-minimization controls before sessions_send, including filtering and redaction.
• Provide a request option that disables memory access and sends only the current prompt.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:42

Finding

Unbounded Persistent Storage of Image Prompts and User Feedback

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-47
Vulnerability Type: Persistent plaintext storage of potentially sensitive user content
Risk Level: Medium

Vulnerable Code

markdown

## Memory Tracking

Log to `memory/image-requests.md`:
- Request ID
- Prompt
- Model used
- Result (success/fail)
- User feedback

Technical Analysis

The skill requires complete prompts and user feedback to be written to memory/image-requests.md. Image prompts and feedback may contain names, personal details, confidential concepts, internal project information, or other sensitive content.

The instruction does not define user consent, data classification, redaction, file permissions, encryption, retention periods, deletion procedures, or access boundaries. It also does not limit logging to metadata necessary for operational tracking. Storing the complete content in a Markdown file creates a persistent plaintext record that may be available to future sessions or other components with memory access.

This is an insecure data-handling practice rather than agent memory poisoning: the file records user content and operational metadata, but the reviewed instructions do not direct the agent to store attacker-controlled rules that govern future sessions.

Attack Path

1. A user submits an image-generation prompt containing sensitive or confidential information.
2. The skill processes and hands off the request.
3. The complete prompt, result status, model information, and subsequent feedback are appended to memory/image-requests.md.
4. The data persists beyond the immediate image-generation task.
5. A later session, agent, tool, backup process, or user with access to the memory file reads the retained content.
6. Sensitive information is exposed outside the context in which it was originally provided.

Exploitation requires access to the memory file or to an agent/tool capable of reading it. T ...[truncated 564 chars]

Remediation

View remediation

Remediation Suggestions

• Make persistent logging opt-in and explain exactly which data will be retained.
• Store only minimal operational metadata, such as a random request identifier, timestamp, and success status.
• Do not retain complete prompts or feedback unless required for a documented purpose.
• Redact personal data, credentials, confidential information, and other sensitive values before writing logs.
• Apply restrictive file permissions so only the necessary component can access the log.
• Define and enforce a short retention period with automatic deletion.
• Provide users with mechanisms to inspect and delete stored request history.
• If sensitive retention is unavoidable, use an approved protected storage mechanism rather than a general plaintext Markdown file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

## Detection Patterns

**Explicit trigger:**
- `!img <prompt>` — immediate handoff, no confirmation

**Auto-detection (ask for confirmation):**
- "draw me...", "generate an image of...", "make a picture of..."

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The auto-detection phrases are broad enough to match ordinary conversation and can trigger the image-routing workflow when the user did not intend to invoke this skill. In this skill's context, unintended invocation can expose user prompts and associated context to another agent and may cause unnecessary processing or logging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to forward the user's prompt, memory-derived style preferences, and a tracking identifier to another agent, and separately to log request details persistently, but it provides no notice, consent, or minimization guidance. This creates a real privacy and data-governance risk because user content and inferred preferences may be shared and retained beyond what the user expects.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This instruction explicitly forwards user-derived preference data from memory to another agent, which is a cross-agent data-sharing action involving potentially sensitive behavioral profile information. Even if intended to improve personalization, forwarding stored preferences without user awareness or necessity increases privacy exposure and the blast radius of any downstream misuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates persistent logging of prompts, request IDs, model details, results, and user feedback, creating a durable record of user activity that may contain sensitive or identifying information. Persistent storage increases privacy risk, retention risk, and the consequences of unauthorized access or secondary use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.