Ai Artist Workstation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.3

Overview

This skill is mostly an AI-art order workflow, but it asks for broad agent/file/command authority while handling face images, customer orders, local saves, and external delivery without enough user control or concrete safeguards.

Review this carefully before installing. Use it only in a dedicated, user-owned output folder, avoid running the agent as administrator, confirm before uploading or sharing customer images, and do not rely on its encryption, backup, access-control, or command-whitelist claims unless your own environment enforces them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:295

Finding

Unnecessary Recommendation to Run with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:295
Vulnerability Type: Least-privilege violation through unjustified privilege escalation guidance
Risk Level: Medium

Vulnerable Snippet

The relevant table row, translated into English, states:

text

Insufficient permissions | The current user lacks read/write permissions | Check file permissions and run as administrator

Technical Analysis

The troubleshooting guidance recommends running the Agent or its commands as an administrator whenever a filesystem permission problem occurs. The documented workflow performs ordinary API calls, file downloads, output-file writes, and delivery operations; it does not establish a legitimate need for system-wide privileges.

This broad recommendation bypasses the principle of least privilege instead of resolving the specific permission problem. Because the Skill declares command-execution capability and relies on unspecified external image-generation and delivery components, subsequent commands or tools could inherit elevated permissions. The document does not constrain elevation to a particular command, validate the command being elevated, require a trusted executable path, or recommend correcting ownership and directory permissions first.

This is guidance rather than an automatic privilege-escalation implementation. Exploitation therefore depends on a user or Agent following the recommendation and successfully approving elevated execution.

Attack Path

1. The image-generation or delivery workflow encounters a read/write permission error.
2. The operator follows the troubleshooting guidance and relaunches the Agent, terminal, or relevant command with administrator privileges.
3. The workflow subsequently invokes an unspecified image engine, delivery utility, script, or command through the declared execution capability.
4. A compromised, substituted, or otherwise unsafe component executes with the inherited ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the general instruction to run the Agent or terminal as an administrator.
2. Direct generated files to a dedicated, user-owned output directory with narrowly scoped read and write permissions.
3. Diagnose the specific failure by checking the target path, ownership, access-control entries, mount state, and available storage.
4. Correct ownership or permissions only for the required file or directory rather than elevating the entire workflow.
5. If elevation is genuinely unavoidable, identify the exact trusted command that requires it and elevate only that command after explicit user confirmation.
6. Require canonical executable paths, fixed arguments, and validation that no user-controlled input is incorporated into privileged commands.
7. Run external image engines, download utilities, and delivery components in a sandbox or restricted service account without administrative access.
8. Log elevation requests and reject attempts to elevate unspecified commands, downloaded executables, or dynamically assembled command lines.

A safer troubleshooting entry would be:

text

Insufficient permissions | The current user cannot access the target path | Use a user-owned output directory or correct the minimum required file permissions; do not run the entire Agent as administrator

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation description uses very broad trigger language such as using the skill whenever AI model calling, agent orchestration, or LLM applications are needed, without scoping it to image-generation/order-fulfillment tasks. Overbroad activation increases the chance the skill is invoked in unrelated contexts where it may process sensitive inputs, perform local file operations, or trigger networked workflows unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes downloading generated images to local storage and delivering outputs through cloud/network links, but it does not require an explicit user warning or consent flow for handling prompts, face images, local paths, or customer order data. Because the workflow involves potentially sensitive biometric-like reference photos and external file delivery, silent storage and transfer materially increase privacy and data-leakage risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill makes concrete security assurances about encrypted handling, access control, human review, and regular backups, but the document provides no implementation details, configuration steps, or enforceable controls that would make those claims true. In a workflow that handles user prompts, face images, locally downloaded files, and delivery links, unsupported security claims can mislead operators into trusting the skill with sensitive data under false assumptions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares that only whitelisted commands are executed and that user input is not used in command construction, yet it also requires exec capability and describes file handling workflows without defining any actual whitelist or safe invocation model. This creates a dangerous mismatch: an agent or operator may assume command execution is constrained when in reality downstream implementations could interpolate untrusted prompt text, file paths, or order data into shell commands, enabling command injection or unsafe file operations.

Content

No source excerpt is available for this finding.