LayerBack Image to VSDX

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:22 AM UTC
• Version: 1.0.0

Overview

The skill’s main conversion purpose is clear, but it needs review because installation is unpinned and a configurable API endpoint can receive both the diagram and API key.

Before installing, prefer a pinned installer version or local reviewed install instead of the README’s latest/global npx command. Use the default LayerBack endpoint unless you fully trust a custom endpoint, because the custom endpoint receives the uploaded diagram and the API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/layerback_convert.py:191

Finding

Configurable API Endpoint Can Exfiltrate the API Key and Source Image

Content

View full analysis

Vulnerability Details

File Location: scripts/layerback_convert.py, lines 65-75 and 191-217
Vulnerability Type: Unrestricted sensitive-data destination
Risk Level: High

Vulnerable Code

python

def api_json(
    method: str,
    url: str,
    api_key: str,
    *,
    body: Optional[bytes] = None,
    content_type: Optional[str] = None,
) -> Dict[str, Any]:
    headers = {
        "Accept": "application/json",
        "User-Agent": "LayerBack-Skill/1.0",
        "x-api-key": api_key,
    }
    if content_type:
        headers["Content-Type"] = content_type

python

api_base_url = os.getenv(
    "LAYERBACK_API_BASE_URL", DEFAULT_API_BASE_URL
).strip().rstrip("/")
parsed_base_url = urllib.parse.urlparse(api_base_url)
local_hosts = {"localhost", "127.0.0.1", "::1"}
if parsed_base_url.scheme != "https" and not (
    parsed_base_url.scheme == "http" and parsed_base_url.hostname in local_hosts
):
    die("LAYERBACK_API_BASE_URL must use HTTPS (HTTP is allowed for localhost).")

destination = (
    Path(args.out).expanduser().resolve()
    if args.out
    else source.with_suffix(f".{args.format}")
)
started = time.monotonic()
try:
    created = api_json(
        "POST",
        f"{api_base_url}/convert",
        api_key,
        body=source.read_bytes(),
        content_type="application/octet-stream",
    )

Technical Analysis

The converter reads LAYERBACK_API_BASE_URL from the process environment and permits any endpoint that uses HTTPS. It does not restrict the hostname to the documented LayerBack service, validate an approved port, reject embedded user information, or require separate credentials for custom endpoints.

The selected endpoint receives both the complete source image as the HTTP request body and LAYERBACK_API_KEY in the x-api-key header. Consequently, control of the environment variable is sufficient to redirect s ...[truncated 1821 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict normal operation to the exact official origin and expected API path:
   • Scheme: https
   • Hostname: layerback.com
   • Expected base path: /api/v1
   • Reject unexpected ports, usernames, passwords, fragments, or query strings.
2. Remove LAYERBACK_API_BASE_URL unless endpoint customization is essential to the supported functionality.
3. If custom endpoints are required for development, place them behind an explicit option such as --allow-custom-api-endpoint, display the destination, and require interactive confirmation before transmitting any data.
4. Never send a production LAYERBACK_API_KEY to a custom endpoint. Require a separate development credential or omit authentication for local test servers.
5. Validate the final constructed URL rather than validating only the raw base URL.
6. Document the endpoint trust boundary and ensure users are told the exact hostname receiving the image and credential before conversion.
7. Add tests confirming that lookalike domains, embedded credentials, unexpected ports, malformed URLs, and non-approved hosts are rejected.

T08 · Insecure Dependencies

Warning

• Location: README.md:18

Finding

Installation Instructions Execute an Unpinned Remote Package Globally

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 18-22
Vulnerability Type: Unpinned executable dependency and unsafe installation scope
Risk Level: Medium

Vulnerable Code

bash

npx -y skills@latest add TopLocalAI/layerback-image-to-vsdx-skill \
  --skill layerback-image-to-vsdx \
  --agent codex \
  --global

Technical Analysis

The documented installation command uses npx to download and execute skills@latest. The latest tag is mutable and therefore does not identify the exact package version that was reviewed. The -y option automatically accepts installation without an additional user decision, while --global broadens the resulting installation's scope.

This package is not required by the converter itself, which uses Python standard-library modules only. The instruction therefore introduces a remote executable supply-chain component outside the audited project. A future malicious or compromised release associated with skills@latest could execute code as the invoking user during installation.

The reviewed repository does not establish that the current upstream package is malicious. The vulnerability is the unsafe, mutable trust model in the recommended command.

Attack Path

1. The package publisher account, registry, release process, or another relevant supply-chain component is compromised, or an unsafe future release is assigned to the latest tag.
2. A user follows the README installation instructions.
3. npx -y retrieves the package currently referenced by skills@latest without pinning it to the audited version.
4. Package lifecycle or command-entry code executes with the user's operating-system privileges.
5. The compromised package can access files and environment variables available to that user and can alter globally scoped agent configuration or installed Skill content.

Impact Assessment

Malicious package code would execute with the privilege ...[truncated 513 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace skills@latest with an exact, reviewed package version.
2. Where supported, verify the downloaded package with a lockfile, integrity hash, signature, or package provenance information.
3. Remove -y so users can review the package and installation decision before execution.
4. Prefer project-local or user-scoped installation instead of --global.
5. Provide a manual installation method that retrieves a pinned repository commit or release archive and allows inspection before installation.
6. Document the expected package publisher, version, checksum, and resulting installation paths.
7. Update pinned versions deliberately after security review rather than relying on a mutable release tag.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run npx -y skills@latest ..., which fetches and executes the latest published package version at install time rather than a pinned, reviewed release. If the upstream package is compromised or a breaking/malicious version is published, users installing the skill could execute untrusted code on their machine.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs use of environment variables, local file reads/writes, and outbound network access, but it does not declare any explicit tool scope or allowed-tools boundaries. In an agent ecosystem, that omission can lead to overbroad execution privileges, making unauthorized file access or uploads more likely if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file is primarily written in English, but the section header and link labels on lines L040-L047 switch to Chinese only. This imposes a language choice on users without opt-in and no region-specific justification is provided in the skill description.

Content

No source excerpt is available for this finding.