Generate Product Mockup Photos

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill is for product mockup image generation, but it declares broad Bash and file-read access that is not explained by that purpose.

Review this skill before installing. Its image-generation purpose is straightforward, but it requests shell and local file-read authority without explaining why. Prefer a version that removes Bash and Read or clearly scopes when any local access is needed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:11

Finding

Excessive Bash and Filesystem Read Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:11
Vulnerability Type: Excessive tool permissions violating least privilege
Risk Level: Medium

Vulnerable Code Snippet:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill declares access to the Bash and Read tools, although its documented purpose is to generate product mockup images and its only listed API is image_generation (SKILL.md:42-44). No documented workflow step requires arbitrary command execution or unrestricted local file reading.

This permission set exceeds the skill's legitimate functional requirements. If the host platform grants these tools according to this declaration, malicious or attacker-controlled instructions introduced through a user prompt, external content, or a later modification to the skill could invoke shell commands or inspect files available to the agent. The declaration does not itself execute commands, but it unnecessarily exposes powerful capabilities that could make a subsequent prompt-injection or skill-compromise event materially more damaging.

Attack Path

1. A user installs and loads the skill.
2. The host grants the skill the declared Bash and Read capabilities.
3. The skill processes attacker-controlled input or compromised follow-on instructions.
4. Those instructions direct the agent to invoke Read against accessible local files or use Bash to execute operating-system commands.
5. Commands run with the privileges of the hosting agent process, allowing access beyond what image generation requires.

Impact Assessment

Successful exploitation could allow reading files accessible to the agent process and executing arbitrary shell commands under that process's operating-system account. The practical scope depends on the host's sandboxing, command approval controls, filesystem restrictions, and runtime identity. Potential consequences include disclosure of local data, modifi ...[truncated 146 chars]

Remediation

View remediation

Remediation Suggestions

Remove Bash and Read from allowed-tools and grant only the image-generation capability required by the documented workflow. If the platform requires filesystem access for a specific future feature, restrict it to explicitly approved paths and read-only operations. If shell access becomes unavoidable, expose narrowly scoped commands through a dedicated wrapper rather than unrestricted Bash, validate all arguments against an allowlist, require user confirmation for sensitive operations, and run the skill in a sandbox with minimal filesystem and network access. Add automated checks that compare declared tools with documented functionality to prevent excessive permissions from being reintroduced.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The 'Use When' guidance says to use the skill for 'e-commerce work for startups, solopreneurs, agencies,' which is a broad context rather than a specific invocation condition. It does not define what kinds of requests should or should not activate this skill, increasing the chance of unintended invocation across many ordinary e-commerce tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.