Imagen 4 AI Image Generator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:07 AM UTC
• Version: 1.0.4

Overview

This skill mostly matches an Imagen 4 image-generation client, but it also exposes and directly demonstrates an account credit-balance API that is not clearly disclosed in the main purpose.

Review this before installing if you only expected image generation. The skill needs a Media.io API key and sends prompts to Media.io, and it also includes a credit-balance query. Use a dedicated API key with limited privileges if available, avoid sensitive prompt content, and prefer a pinned dependency setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Third-Party HTTP Dependency

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/skill_router.py:50

Finding

Path Parameter Substitution Occurs After URL Security Validation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is presented as a dedicated Imagen 4 image generator, but the implementation pattern shown relies on a generic router over a local API definition file and can invoke other documented Media.io APIs, including non-image/account-related endpoints. That mismatch is dangerous because operators may approve the skill for a narrow purpose while it retains broader API reach, increasing the chance of unauthorized actions, data exposure, or unexpected billing-related operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill uses environment access, file reads, and networked API calls but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an avoidable transparency and governance gap: a host may permit broader capabilities than users expect, and reviewers cannot easily constrain execution to only the intended API interaction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for generating AI images via Google Imagen 4, but this file also documents a separate /user/credits endpoint for querying account credit balances. Account/usage inspection is adjacent to the service, but it is still a broader behavior than pure image generation as described in the manifest.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/c_api_doc_detail.json (reported line 12)May include surrounding context.

json

"description": "API to query user credits balance.",
    "api_header": "{\"list\": [{\"name\": \"X-API-KEY\", \"value\": \"API key to authorize requests\"}, {\"name\": \"Content-Type\", \"value\": \"application/json\"}], \"title\": \"Authorizations\", \"describe\": \"Add the following authorization information in the request header\"}",
    "api_body": "{\"title\": \"Request Body\", \"category\": [{\"list\": [], \"title\": \"Query Credits\", \"describe\": \"Request body to query user credits balance\"}]}",
    "api_request_demo": "{\"title\": \"Example Request\", \"request\": [{\"title\": \"Query User Credits\", \"language\": \"cURL\", \"code_example\": \"curl --request POST \\\\n  --url https://openapi.media.io/user/credits \\\\n  --header 'Content-Type: application/json' \\\\n  --header 'X-API-KEY: <api-key>' \\\\n  --data '{}'\"}]}",
    "api_response": "{\"list\": [{\"name\": \"code\", \"type\": \"integer\", \"describe\": \"Response status code, 0 indicates success\"}, {\"name\": \"msg\", \"type\": \"string\", \"describe\": \"Response message, empty string on success\"}, {\"name\": \"data\", \"type\": \"object\", \"describe\": \"Response data object\"}, {\"name\": \"credits\", \"type\": \"integer\", \"describe\": \"User credits balance, located within the data object\"}], \"title\": \"Response\", \"describe\": \"After the request is successfully processed, the server will return the following response\"}",
    "api_code_demo": "{\"list\": [{\"code\": \"0\", \"describe\": \"Success\"}, {\"code\": \"40001\", \"describe\": \"Invalid API key\"}, {\"code\": \"40002\", \"describe\": \"API key expired\"}], \"title\": \"Status Code\"}",
    "content": null,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file performs a network call and sends both an API credential in the header and user-supplied parameters in the JSON body. While there are developer comments and docstrings, there is no user-facing confirmation, print/log disclosure, or other explicit warning that data will be transmitted to an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest and overview describe the skill as generating images from text prompts via Imagen 4, which implies creation requests only. The documented usage also includes a separate 'Task Result' operation to poll task status, an additional behavior not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON documentation instructs users to supply an X-API-KEY authorization header, which involves handling sensitive credentials. The file provides no accompanying warning about protecting the key, avoiding exposure in logs or shared examples, or treating it as secret material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The cURL example shows a POST request that sends an X-API-KEY header to a remote endpoint. Although this is expected for an API client, the documentation does not warn users that the request transmits credentials and should be used carefully in shells, histories, and shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This section documents the X-API-KEY header required for authorization but does not include any disclosure that the value is a secret credential. For documentation that instructs users to include credentials in requests, a minimal warning helps prevent accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The request body defines a prompt field and the example sends it to openapi.media.io, which means user-provided content is transmitted off-system. The documentation does not disclose this privacy-relevant behavior or advise against sending sensitive personal or confidential content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.