Text to Image API

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:09 AM UTC
• Version: 1.0.2

Overview

The skill mostly supports Media.io image generation, but it also exposes and demonstrates an account credits lookup that is not clearly disclosed in the main text-to-image description.

Review this before installing if you only expect image generation. The skill needs a Media.io API key and sends requests to Media.io; it can also query your Media.io credits balance through the bundled router. Prefer running it in a dedicated environment and consider pinning dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:62

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 62
Vulnerability Type: Unpinned package installation from a mutable package repository
Risk Level: Low

Vulnerable Code

bash

pip install requests

Technical Analysis

The installation instructions retrieve the latest available version of requests and its transitive dependencies from the package index configured in the user's environment. No reviewed version, lock file, package hash, or trusted index is specified.

Because dependency resolution is mutable, the code installed by this command may differ between installations. Exploitation would require a supply-chain compromise, such as compromise of a relevant package release or dependency, control of the configured package index, or package-resolution manipulation. A malicious package could execute code during package build or installation, or when imported by scripts/skill_router.py.

This finding does not establish that the legitimate requests package is malicious. It identifies the absence of controls that ensure users install the same reviewed dependency artifacts.

Attack Path

1. An attacker compromises a resolved package release or a package index configured in the victim's Python environment.
2. A user follows the documented setup instruction and runs pip install requests.
3. Pip resolves and downloads the attacker-controlled or modified package because the documentation does not constrain versions, hashes, or the package source.
4. Malicious code executes during package installation, wheel or source build processing, or subsequent import.
5. The code runs with the privileges of the user or automation account performing the installation or invoking the skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the installing user's security context. The attacker could potentially access files, environment variables such as API_KEY, and network resources available to ...[truncated 390 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin reviewed direct and transitive dependency versions in a requirements or lock file.
2. Record cryptographic hashes for every permitted distribution and install with hash enforcement:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate the lock file through a controlled dependency-review process and update it only after security and compatibility testing.
4. Use an explicitly approved package index or internal package mirror rather than relying on arbitrary user-level pip configuration.
5. Prefer prebuilt, reviewed wheels and disable unexpected source builds where operationally practical.
6. Run installation and skill execution in a dedicated virtual environment or container with minimal filesystem, credential, and network access.
7. Add automated dependency vulnerability and integrity scanning to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill is presented as a narrow text-to-image generator, but the examples and related files indicate a generic router that can invoke arbitrary Media.io API definitions from a local JSON file. This mismatch is dangerous because it can enable access to non-advertised endpoints, including account or billing-related APIs, which undermines least privilege and can mislead users and policy enforcement about the true behavior of the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents use of environment variables, file-based routing metadata, and outbound network access, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: a host agent may expose broader capabilities than users expect, and reviewers cannot easily verify that the skill is limited to only the minimum required actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file documents a user/credits endpoint that is outside the skill's stated purpose of generating images from text prompts. This broader API surface can enable unnecessary account-state queries and increases the permissions and behaviors exposed by the skill beyond user expectations, which is a scope-expansion issue even if the endpoint is not inherently dangerous on its own.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/c_api_doc_detail.json (reported line 12)May include surrounding context.

json

"description": "API to query user credits balance.",
    "api_header": "{\"list\": [{\"name\": \"X-API-KEY\", \"value\": \"API key to authorize requests\"}, {\"name\": \"Content-Type\", \"value\": \"application/json\"}], \"title\": \"Authorizations\", \"describe\": \"Add the following authorization information in the request header\"}",
    "api_body": "{\"title\": \"Request Body\", \"category\": [{\"list\": [], \"title\": \"Query Credits\", \"describe\": \"Request body to query user credits balance\"}]}",
    "api_request_demo": "{\"title\": \"Example Request\", \"request\": [{\"title\": \"Query User Credits\", \"language\": \"cURL\", \"code_example\": \"curl --request POST \\\\n  --url https://openapi.media.io/user/credits \\\\n  --header 'Content-Type: application/json' \\\\n  --header 'X-API-KEY: <api-key>' \\\\n  --data '{}'\"}]}",
    "api_response": "{\"list\": [{\"name\": \"code\", \"type\": \"integer\", \"describe\": \"Response status code, 0 indicates success\"}, {\"name\": \"msg\", \"type\": \"string\", \"describe\": \"Response message, empty string on success\"}, {\"name\": \"data\", \"type\": \"object\", \"describe\": \"Response data object\"}, {\"name\": \"credits\", \"type\": \"integer\", \"describe\": \"User credits balance, located within the data object\"}], \"title\": \"Response\", \"describe\": \"After the request is successfully processed, the server will return the following response\"}",
    "api_code_demo": "{\"list\": [{\"code\": \"0\", \"describe\": \"Success\"}, {\"code\": \"40001\", \"describe\": \"Invalid API key\"}, {\"code\": \"40002\", \"describe\": \"API key expired\"}], \"title\": \"Status Code\"}",
    "content": null,

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest describes a skill for generating AI images from text prompts, but the code's demonstrated invocation targets a 'Credits' API rather than an image-generation operation. Account/usage inspection is related to the vendor API, but it is still a broader behavior than the narrow user-facing description claims.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.