Stable Diffusion Sd3

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.2

Overview

The skill is a mostly coherent local Stable Diffusion setup guide, with some overbroad optional fleet features and dependency-install caveats users should understand.

Install only if you trust the referenced PyPI/uv packages and the local fleet router. Use an isolated environment, avoid running the referenced patch script unless you verify its source, and treat LLM, transcription, and embedding endpoints as separate optional features requiring explicit user intent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Packages Introduce Supply-Chain Code Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-48
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install ollama-herd    # Stable Diffusion fleet router from PyPI

bash

uv tool install diffusionkit    # Stable Diffusion 3 and SD3.5 backend

bash

uv tool install mflux

Technical Analysis

The installation instructions retrieve third-party packages without fixed versions, cryptographic hashes, or a reviewed lockfile. Consequently, the code installed by these commands can change independently of the audited Skill.

Python package installation may execute package-controlled build hooks, while the installed command-line programs execute package code when subsequently invoked. A compromised package release, transitive dependency, or package-index resolution could therefore introduce arbitrary code that was not present during this audit.

The Skill does not request administrative privileges, so this issue does not directly constitute privilege escalation. Nevertheless, dependency code would run with the privileges of the user performing the installation or invoking the installed tools.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, or the corresponding package-index account.
2. The attacker publishes a malicious release under a version accepted by the unpinned installation command.
3. A user follows the Skill's setup instructions.
4. pip or uv resolves and downloads the attacker-controlled release.
5. Malicious code executes through package build or installation behavior, or when the installed command-line tool is invoked.
6. The malicious dependency gains access to the installing user's files, credentials, network connectivity, and other resources available to that account.

Impact Assessment

Successful exploitation could provide arbitrary code exec ...[truncated 552 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed, exact version, for example package==x.y.z.
2. Maintain a lockfile that records all transitive dependency versions.
3. Require cryptographic hashes where supported, such as a hash-locked requirements file installed with pip --require-hashes.
4. Document and explicitly configure the trusted package index rather than relying on ambient package-manager configuration.
5. Review package provenance, release signatures, maintainers, and source repositories before updating pinned versions.
6. Install dependencies in an isolated virtual environment or tool environment under a non-administrative account.
7. Test dependency updates in a restricted environment before recommending them to users.
8. Document the exact reviewed package versions in SKILL.md so the installed artifacts correspond to the audited instructions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

bash

# Stable Diffusion generation stats (last 24h)
curl -s http://localhost:11435/dashboard/api/image-stats | python3 -m json.tool

# Which nodes have Stable Diffusion models
curl -s http://localhost:11435/fleet/status | python3 -c "

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

curl -s http://localhost:11435/dashboard/api/image-stats | python3 -m json.tool

# Which nodes have Stable Diffusion models
curl -s http://localhost:11435/fleet/status | python3 -c "
import sys, json
# Stable Diffusion node inspection
for n in json.load(sys.stdin).get('nodes', []):

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest description is very broad and promotional, describing multiple model families and fleet-wide routing without clear trigger constraints or usage boundaries. Ambiguous scope increases the risk that an agent invokes the skill in situations not intended by the user, especially when multiple AI capabilities are bundled together.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Stable Diffusion 3 Medium (fast SD3 generation)

bash

curl -o sd3_cityscape.png http://localhost:11435/api/generate-image \
  -H "Content-Type: application/json" \
  -d '{"model": "sd3-medium", "prompt": "Stable Diffusion rendering a futuristic cityscape at dusk", "width": 1024, "height": 1024, "steps": 20}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

def generate_stable_diffusion(prompt, model="sd3-medium", width=1024, height=1024):
    """Generate an image using Stable Diffusion SD3 via the fleet router."""
    sd3_response = httpx.post(
        "http://localhost:11435/api/generate-image",
        json={"model": model, "prompt": prompt, "width": width, "height": height, "steps": 20},
        timeout=180.0,

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 70% confidence

Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

def generate_stable_diffusion(prompt, model="sd3-medium", width=1024, height=1024):
    """Generate an image using Stable Diffusion SD3 via the fleet router."""
    sd3_response = httpx.post(
        "http://localhost:11435/api/generate-image",
        json={"model": model, "prompt": prompt, "width": width, "height": height, "steps": 20},
        timeout=180.0,

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill is marketed as a local Stable Diffusion image-generation tool, but the documentation also exposes generic LLM inference, speech-to-text, and embeddings endpoints. This expands the operational scope far beyond the stated purpose, increasing the chance that an agent or user invokes unintended high-capability services and weakening least-privilege expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Advertising generic LLM inference inside a Stable Diffusion-specific skill creates a misleading trust boundary: a user enabling image generation may unknowingly enable text-generation capabilities too. This broadens misuse potential and can cause agents to route prompts or sensitive context into services that were never intended to be part of the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Documenting speech-to-text and embeddings in an image-generation skill introduces unrelated data-processing capabilities that may handle sensitive audio or text without users expecting it. In an agent setting, this kind of capability overloading can lead to accidental collection, routing, or processing of data outside the consented use case.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Speech-to-text

bash

curl http://localhost:11435/api/transcribe -F "file=@recording.wav" -F "model=qwen3-asr"

Embeddings

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The description mixes English, Chinese, and Spanish in the default skill metadata without indicating that the user requested or opted into a specific language. This can violate language/locale expectations where skills should respect user language preference unless a multilingual or region-specific requirement is clearly documented.

Content

No source excerpt is available for this finding.