Security audit

WeryAI Image Generator

Security checks for vulnerabilities and agentic risk

Overview

This WeryAI image skill mostly matches its purpose, but it needs review because it can send API keys, prompts, and local files to configurable network destinations and includes an unpinned npx/bun launcher.

Install only if you trust the publisher and runtime environment. Avoid setting custom WERYAI_BASE_URL or WERYAI_MODELS_BASE_URL, do not provide local file paths unless you intend to upload those exact files, and prefer reviewed entry points such as submit/status/models over the generic npx/bun launcher.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vendor/shared-image-generation/scripts/main.ts:202
Finding: WeryAI API Key Disclosed to Unvalidated Image Result URLs
Content: View full analysis
``` This behavior is not required for normal public CDN image retrieval and violates credential-scoping principles. The primary WeryAI API credential must only be transmitted to trusted WeryAI API origins. The issue can be exploited if an attacker can influence the image URL returned by the API, compromise an upstream service, manipulate a response, or cause a trusted result URL to redirect to an attacker-controlled host. The code does not demonstrate an origin allowlist or redirect-origin validation before attaching the credential. ### Attack Path 1. The user starts an image-generation operation. 2. The task response supplies an attacker-controlled or compromised URL in ...[truncated 932 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/lib/cli.js:13
Finding: Environment-Controlled API Origins Receive Credentials and Private Generation Data
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/vendor/weryai-core/upload.js:123
Finding: Local Files and API Credentials Can Be Uploaded to Non-Official Hosts
Content: View full analysis
controller.abort(), timeoutMs); let res; try { const defaultOfficialDomains = ['api.weryai.com', 'api-growth-agent.weryai.com']; const uploadUrl = new URL(`${ctx.baseUrl}${apiPath}`); if (!defaultOfficialDomains.includes(uploadUrl.hostname) && !process.env.WERYAI_ALLOW_INSECURE_UPLOAD) { console.warn(`[SECURITY WARNING] Uploading local file to non-official domain: ${uploadUrl.hostname}. Set WERYAI_ALLOW_INSECURE_UPLOAD=1 to suppress this warning if you trust this endpoint.`); } res = await fetch(uploadUrl, { method: 'POST', headers: { Authorization: `Bearer ${ctx.apiKey}`, }, body: form, signal: controller.signal, }); ``` ### Technical Analysis The upload routine detects non-official domains but merely logs a warning and continues. Consequently, hostname validation provides no security enforcement. A local file is fully read into memory and transmitted together with the WeryAI bearer key to the configured endpoint. The core uploader accepts multiple non-image extensions, including `.txt`, `.md`, `.json`, `.csv`, `.xml`, `.yaml`, and `.yml`. Although the image-specific wrapper p ...[truncated 1505 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/vendor/weryai-image/run-generate.mjs:34
Finding: Unpinned Runtime Package Retrieval and Execution via NPX
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on generating images and managing image-generation tasks through WeryAI APIs. The supplied code chunk instead provides a command-line entry point specifically for checking remaining WeryAI image balance. That is a materially different primary purpose and an undeclared capability relative to the description. While both relate to WeryAI image services, balance inquiry is not represented in the declared purpose, and none of the stated generation/task-management behaviors appear in this chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code chunk does not implement or expose image generation behavior. It simply imports and re-exports a balance-related executor from weryai-core/balance.js. That suggests the actual behavior is checking account balance or usage state, which is not mentioned in the declared purpose. Because the declared description focuses on image creation and related task orchestration, while this code chunk exposes a different capability, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a full-featured WeryAI image-generation skill. However, the supplied code chunk is only a library barrel file that re-exports error utilities from another module. On its own, this code does not perform the described actions or expose behavior related to image generation workflows. Because the actual code's purpose is limited to error export support rather than the declared primary functionality, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk's primary purpose is model listing/discovery via a command-line script (models-image.js), not image generation. The declared description focuses on generating images and managing generation workflows through WeryAI image APIs. While model-related functionality is mentioned in the description as 'model switching,' that is materially different from listing available models and capabilities. Therefore the code behavior shown is not accurately represented by the declared purpose.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This code chunk's primary purpose is account/resource balance lookup, not image generation. It calls a balance endpoint, normalizes the returned credit value, and reports it. That is materially different from the declared purpose centered on text-to-image and image-to-image generation workflows. While this may belong to the same vendor/API family, the implemented capability is undeclared and unrelated to the specific generation behaviors claimed in the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description centers on image generation workflows via WeryAI APIs. However, the supplied code chunk only retrieves and returns available models from a registry, filtered by mode. While model selection/switching may be related at a broader skill level, this specific code does not generate images or perform any of the described generation/task-management actions. Its primary purpose in this chunk is model listing, which is materially different from the declared purpose.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/main.ts (reported line 449)May include surrounding context.
ts
async function loadEnv(projectRoot = resolveProjectRoot()): Promise<void> { const home = homedir(); const mergedFiles = { ...(await loadEnvFile(path.join(home, ".publish-disabled-image-config", SKILL_NAMESPACE, ".env"))), ...(await loadEnvFile(path.join(projectRoot, ".publish-disabled-image-config", SKILL_NAMESPACE, ".env"))), }; for (const [k, v] of Object.entries(mergedFiles)) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/main.ts (reported line 450)May include surrounding context.
ts
async function loadEnv(projectRoot = resolveProjectRoot()): Promise<void> { const home = homedir(); const mergedFiles = { ...(await loadEnvFile(path.join(home, ".publish-disabled-image-config", SKILL_NAMESPACE, ".env"))), ...(await loadEnvFile(path.join(projectRoot, ".publish-disabled-image-config", SKILL_NAMESPACE, ".env"))), }; for (const [k, v] of Object.entries(mergedFiles)) {

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/main.ts (reported line 573)May include surrounding context.
ts
} function applyStylePreset(prompt: string, style: StylePreset | null | undefined): string { if (!style) return prompt; return `${prompt.trim()}\n\nStyle preset (${style}): ${STYLE_PRESETS[style]}.`; }

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares required environment variables and explicitly instructs use of networked API calls, but it does not declare a corresponding tool scope such as permissions or allowed-tools. That can weaken runtime policy enforcement and make the skill's external access less transparent to operators, increasing the chance of unintended secret exposure or network use.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation says local file paths are supported and will be uploaded, but later says not to use local file paths for reference images. In a skill that handles network uploads and local media, this ambiguity is dangerous because operators or agents may unintentionally exfiltrate sensitive local files to the remote API.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The code sends prompt text, and in image-to-image mode potentially base64-encoded local image contents, to https://api.weryai.com via POST. While the file has a brief top-level doc comment describing the endpoint, it does not clearly warn users that their prompt and referenced image data will be transmitted off-machine to a third-party service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code performs outbound network requests using a Bearer API key and may send arbitrary request body data, but there is no confirmation prompt or always-on user-facing disclosure for that transmission path. The only visible notice is optional verbose logging, which can be disabled, so the behavior can occur silently from the user's perspective.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The upload helper explicitly permits video, audio, and text/structured-text extensions even though the skill is described as an image-generation capability. That scope expansion increases the chance that callers will transmit unrelated or sensitive local data through this API path, creating an unintended data exfiltration surface beyond the declared functionality.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The source validation accepts arbitrary HTTP and HTTPS URLs and returns them directly without constraining content type, host, or purpose. In an image-generation skill, this broad acceptance can be abused to process non-image remote resources or to pull in attacker-controlled URLs, expanding the skill's behavior beyond its declared scope and weakening trust boundaries around media inputs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This function reads an arbitrary local file path and uploads the file contents to a remote endpoint using the configured API key, but there is no built-in mechanism here to guarantee user awareness or consent for that transmission. In an agent setting, that creates a meaningful risk of unintended disclosure of local files, especially because the helper can upload more than just images and only emits a warning for non-official domains rather than blocking them.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This wrapper launches a subprocess while forwarding nearly the entire parent environment via ...process.env. That can expose secrets such as API keys, tokens, proxy credentials, or CI variables to the child process and any downstream code it invokes, even if those values are not needed for image generation. In a skill context that calls vendor/shared scripts, this broad propagation increases the blast radius if the shared script, its dependencies, or logging behavior are compromised or overly verbose.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a skill for generating images through WeryAI APIs, but this file is a generic launcher that resolves any supplied entry script path and invokes it through npx -y bun. That subprocess-execution capability is broader than the stated image-generation purpose and is not justified by the manifest language itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This TypeScript file contains natural-language text in Chinese in a prominent code comment, and later user-facing output/help also mixes or uses non-English wording without offering a language or locale choice. The policy for SQP-3 says to flag language or locale constraints when a specific language is imposed without opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The script reads WERYAI_API_KEY from the environment to authenticate outbound requests, but there is no explicit warning in the code's user-facing help or logging that the skill accesses credentials from the runtime environment. SQP-2 calls for disclosure around sensitive environment variable access when no other visible warning is present.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code creates an HTTP client from the provided context and immediately performs a GET request to the models API. While failures are logged, there is no user-facing warning, confirmation, or comment/docstring disclosing that skill/runtime context may be sent to an external service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The code submits a request to '/v1/generation/text-to-image' using a body that includes user-provided prompt content. While errors and model warnings are handled, there is no confirmation prompt, user-facing notice, or explanatory comment/docstring in this file indicating that input text will be transmitted to a remote service.
Content: No source excerpt is available for this finding.