Thor Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:05 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent local image-generation helper, but its required shell command can turn an image prompt into unintended local command execution.

Review this skill before installing. It is intended to run a local ComfyUI image generator and save results to your Desktop, but it should be changed to pass the prompt through a non-shell argument-array call or a fixed wrapper before use with untrusted prompts.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:10

Finding

Shell Command Injection Through Unsafely Interpolated Image Prompt

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-14
Vulnerability Type: Shell command injection caused by unsafe interpolation of user-controlled input
Risk Level: High

markdown

## Execution Protocol
When the user asks to generate an image, the assistant MUST execute the following command via the `exec` tool:

```bash
cd ~/ComfyUI && source venv/bin/activate && python3 thor_generate_image.py "{{prompt}}" ~/Desktop/bring_img

Technical Analysis

The skill requires the assistant to substitute the user-controlled image prompt directly into a shell command. Although {{prompt}} appears inside double quotes, shell double quotes still permit command substitution through syntax such as $(command) and backticks. A prompt containing a double quote may also terminate the intended argument and introduce shell operators or additional commands.

Consequently, the prompt is not guaranteed to remain a literal argument to thor_generate_image.py. It may instead alter the command parsed by the shell and execute arbitrary operating-system commands.

Attack Path

1. An attacker asks the assistant to generate an image and includes shell syntax in the image prompt.
2. For example, the prompt could contain $(id > /tmp/thor-proof).
3. The assistant substitutes that text into the documented command:

   bash

   cd ~/ComfyUI && source venv/bin/activate && python3 thor_generate_image.py "$(id > /tmp/thor-proof)" ~/Desktop/bring_img
   

4. The assistant invokes the command through the exec tool.
5. The shell evaluates the command substitution before invoking the Python image generator.
6. The injected operating-system command executes with the same permissions and environment available to the assistant process.

Alternative payloads could break out of the quoted argument and append additional shell commands.

Impact Assessment

Successful exploit ...[truncated 486 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct a shell command by interpolating the prompt into a command string.
• Invoke Python with an argument-array API that bypasses shell parsing. The intended argument vector should be equivalent to:

  text

  ["python3", "thor_generate_image.py", user_prompt, "/home/USER/Desktop/bring_img"]
  

• Configure the working directory and virtual-environment interpreter directly rather than using cd, source, and shell command chaining. For example, invoke ~/ComfyUI/venv/bin/python3 with the working directory set to ~/ComfyUI.
• If the execution interface only accepts shell text, create a fixed, reviewed wrapper that receives the prompt through standard input and passes it to the generator without evaluation. Do not use eval.
• Add validation and resource limits appropriate to image prompts, but do not treat filtering or shell escaping as a substitute for avoiding the shell.
• Run the image-generation process with least privilege, restricted filesystem access, controlled network access, and an output directory dedicated to generated images.
• Add regression tests using prompts containing command substitutions, backticks, quotes, semicolons, newlines, redirects, and shell operators to verify that all such characters are delivered literally to the Python script.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs the assistant to write generated files directly to ~/Desktop/bring_img but does not warn the user that a local filesystem write will occur. This creates an informed-consent and transparency issue, and could lead to unexpected file creation or disclosure of generated content in a user-visible location.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.