Fooocus Image Generation Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

This skill is mostly a Fooocus local image-generation helper, but its installer and runtime guidance create real host-safety and privacy risks that should be reviewed before installation.

Install only if you are comfortable with a skill that can install software, clone remote code, modify files under your home directory, start a local Fooocus service, and send prompts or selected images to a configured API endpoint. Review and preferably patch the installer before use, avoid --force except on a verified Fooocus directory, keep the service bound to localhost, and do not use cloud or remote endpoints with sensitive prompts or personal images unless you explicitly accept that data transfer.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check_env.py:20

Finding

Shell Command Injection Through User-Controlled Installation and Startup Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_fooocus.py:35

Finding

Shell Command Injection in the Standalone Fooocus Installer

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_fooocus.py:220

Finding

Arbitrary Recursive Directory Deletion Through the Force-Reinstall Option

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/install_fooocus.py:14

Finding

Moving Remote Repository and Unpinned Dependencies Are Installed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_image.py:91

Finding

Private Prompts and Images Can Be Sent to Arbitrary Plaintext API Endpoints

Content

View full analysis

str: """Encode image to base64.""" with open(image_path, "rb") as f: return base64.b64encode(f.read()).decode("utf-8") ``` ```python if input_image: encoded = self.encode_image(input_image) payload["data"].append(encoded) if mask_image: encoded = self.encode_image(mask_image) payload["data"].append(encoded) if image_prompt: encoded = self.encode_image(image_prompt) payload["data"].append(encoded) payload["data"].append(image_prompt_weight) try: response = self.session.post( self.predict_url, json=payload, timeout=300 ) ``` The endpoint is controlled by a CLI option: ```python parser.add_argument("--api-url", default=DEFAULT_API_URL, help="Fooocus API URL") ``` Equivalent unrestricted plaintext behavior exists in: ```python # scripts/generate.py url = f"http://{host}:{port}/api/predict" ``` ```python # scripts/generate_with_progress.py self.ws_url = f"ws://{host}:{port}/queue/join" self.http_url = f"http://{host}:{port}" ``` ### Technical Analysis Base64 encoding is not encryption. The encoding behavior is necessary to transport explicitly selected images to the Fooocus API and is not evidence of a covert exfiltration channel. However, the API destination is unrestricted, and the clients support or construct plaintext `http://` and `ws:// ...[truncated 1394 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:1855

Finding

Documentation Encourages Unauthenticated Binding of Fooocus to All Network Interfaces

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (53)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill includes guidance for network connectivity checks to third-party hosts and diagnostics unrelated to the narrow end-user expectation of image generation. While not overtly malicious, combining environment diagnostics, external connectivity tests, and local inspection without precise scoping broadens the operational footprint and may leak metadata or trigger unnecessary outbound traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill includes guidance for network connectivity checks to third-party hosts and diagnostics unrelated to the narrow end-user expectation of image generation. While not overtly malicious, combining environment diagnostics, external connectivity tests, and local inspection without precise scoping broadens the operational footprint and may leak metadata or trigger unnecessary outbound traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill includes guidance for network connectivity checks to third-party hosts and diagnostics unrelated to the narrow end-user expectation of image generation. While not overtly malicious, combining environment diagnostics, external connectivity tests, and local inspection without precise scoping broadens the operational footprint and may leak metadata or trigger unnecessary outbound traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill includes guidance for network connectivity checks to third-party hosts and diagnostics unrelated to the narrow end-user expectation of image generation. While not overtly malicious, combining environment diagnostics, external connectivity tests, and local inspection without precise scoping broadens the operational footprint and may leak metadata or trigger unnecessary outbound traffic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill includes guidance for network connectivity checks to third-party hosts and diagnostics unrelated to the narrow end-user expectation of image generation. While not overtly malicious, combining environment diagnostics, external connectivity tests, and local inspection without precise scoping broadens the operational footprint and may leak metadata or trigger unnecessary outbound traffic.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

This is a true tool-parameter-abuse issue because shell=True turns command text into a shell-interpreted program, and this helper is used to run install and clone operations. Any attacker-controlled content reaching cmd can inject additional shell commands, which is especially dangerous in a skill designed to modify the local environment.

Content

Scanner excerpt · scripts/check_env.py (reported line 26)May include surrounding context.

python

"""Run a shell command and return output"""
    try:
        if capture:
            result = subprocess.run(
                cmd, shell=True, cwd=cwd, capture_output=True, text=True, timeout=timeout
            )
            return result.returncode == 0, result.stdout, result.stderr

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The non-capturing execution path has the same shell injection sink and exposes the same abuse primitive. Because this utility performs installation-related tasks, successful exploitation can result in arbitrary package installation, file modification, or command execution as the local user.

Content

Scanner excerpt · scripts/check_env.py (reported line 31)May include surrounding context.

python

)
            return result.returncode == 0, result.stdout, result.stderr
        else:
            result = subprocess.run(cmd, shell=True, cwd=cwd, timeout=timeout)
            return result.returncode == 0, "", ""
    except subprocess.TimeoutExpired:
        return False, "", "Command timed out"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate Popen finding is a true vulnerability for the same reason: shell=True on a concatenated command string containing external input enables arbitrary command execution. The skill's purpose of installing and launching local AI tooling increases exposure because it already expects filesystem and process-level access.

Content

Scanner excerpt · scripts/check_env.py (reported line 263)May include surrounding context.

python

# Start in background
    if sys.platform == "win32":
        subprocess.Popen(
            cmd, cwd=path, shell=True,
            creationflags=subprocess.CREATE_NEW_CONSOLE
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate Popen finding is a true vulnerability for the same reason: shell=True on a concatenated command string containing external input enables arbitrary command execution. The skill's purpose of installing and launching local AI tooling increases exposure because it already expects filesystem and process-level access.

Content

Scanner excerpt · scripts/check_env.py (reported line 263)May include surrounding context.

python

# Start in background
    if sys.platform == "win32":
        subprocess.Popen(
            cmd, cwd=path, shell=True,
            creationflags=subprocess.CREATE_NEW_CONSOLE
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate non-Windows Popen finding is also a true vulnerability; shell metacharacters in interpolated values can alter command behavior or append attacker commands. In this environment-management script, exploitation could compromise the host running the agent skill.

Content

Scanner excerpt · scripts/check_env.py (reported line 268)May include surrounding context.

python

creationflags=subprocess.CREATE_NEW_CONSOLE
        )
    else:
        subprocess.Popen(
            cmd, cwd=path, shell=True,
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This duplicate non-Windows Popen finding is also a true vulnerability; shell metacharacters in interpolated values can alter command behavior or append attacker commands. In this environment-management script, exploitation could compromise the host running the agent skill.

Content

Scanner excerpt · scripts/check_env.py (reported line 268)May include surrounding context.

python

creationflags=subprocess.CREATE_NEW_CONSOLE
        )
    else:
        subprocess.Popen(
            cmd, cwd=path, shell=True,
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL
        )

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/generate.py (reported line 224)May include surrounding context.

python

parser.add_argument("--output-dir", default=DEFAULT_OUTPUT_DIR, help="Output directory")
    
    # Behavior
    parser.add_argument("--skip-check", action="store_true", help="Skip environment check")
    parser.add_argument("--cpu-optimize", action="store_true", help="Optimize for CPU mode")
    parser.add_argument("--verbose", "-v", action="store_true", help="Verbose output")
    parser.add_argument("--timeout", type=int, default=300, help="Request timeout")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Using subprocess.run with shell=True in a generic wrapper creates a tool-abuse primitive: any tainted input that reaches cmd can escape intended boundaries and execute arbitrary shell commands. In the context of an installer that handles filesystem paths and package operations, this can lead to local code execution under the user's account.

Content

Scanner excerpt · scripts/install_fooocus.py (reported line 41)May include surrounding context.

python

"""Run a shell command"""
    try:
        if capture:
            result = subprocess.run(
                cmd, shell=True, cwd=cwd, capture_output=True, text=True, timeout=timeout
            )
            return result.returncode == 0, result.stdout, result.stderr

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

The non-capturing subprocess path repeats the same unsafe shell=True behavior, so the wrapper remains dangerous regardless of output mode. This broadens the attack surface because future commands may be added to this helper under the assumption it is safe.

Content

Scanner excerpt · scripts/install_fooocus.py (reported line 46)May include surrounding context.

python

)
            return result.returncode == 0, result.stdout, result.stderr
        else:
            result = subprocess.run(cmd, shell=True, cwd=cwd, timeout=timeout)
            return result.returncode == 0, "", ""
    except subprocess.TimeoutExpired:
        return False, "", "Command timed out"

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/install_fooocus.py (reported line 243)May include surrounding context.

python

# Create launcher
    create_launcher_scripts(args.path)
    
    # Print instructions
    print_post_install(args.path)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick reference tells the agent to steer users to Google Colab and Hugging Face when no GPU is present, even though the skill is described as local Fooocus image generation. This creates scope drift: a user invoking a local-only skill could be redirected to third-party services, causing unintended data disclosure of prompts or images and violating user expectations about where content is processed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructions tell the agent to run dependency installation automatically ('Let me install it for you') without first obtaining explicit consent or clearly warning that packages will be installed and the system modified. Automatic installs change the host environment, consume bandwidth and disk, and increase risk when performed by an autonomous agent on behalf of a user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guidance initiates Fooocus installation and a multi-gigabyte model download without an explicit confirmation step before the action. This is risky because it can trigger substantial network, storage, and environment changes that the user did not knowingly authorize, especially in an agent-driven workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The fallback section instructs the agent to suggest external cloud services if local setup fails, which is behavior outside the stated local-generation scope. In practice, this can cause sensitive prompts, reference images, or inpainting inputs to be sent to third-party providers without the user anticipating that change in trust boundary.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly recommends Google Colab and Hugging Face, which are cloud-hosted services, even though the skill is described as local-only Fooocus image generation. This can misroute users from a local privacy-preserving workflow to third-party platforms, creating data exposure and policy-boundary violations if users upload sensitive prompts or images.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares requirements and operational steps that imply shell execution, network access, and filesystem modification, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this can cause the skill to obtain or appear to justify broad capabilities without user-visible restrictions, increasing the chance of unintended installs, downloads, and local changes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger language is very broad and may activate the skill for generic image-related requests whenever Fooocus is merely mentioned. Overbroad invocation increases the chance that an agent will enter a setup/install/service-management flow unexpectedly, performing privileged actions in contexts where the user only intended a normal conversation or a different tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill supports face swap, style transfer, image prompt, and user image upload workflows but does not prominently warn about privacy, consent, biometric sensitivity, or copyright concerns. This omission can lead to misuse of personal or third-party images and accidental processing of sensitive content without informed user consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation markets the workflow as local/offline, but repeatedly instructs package installation, GitHub/community lookups, and model downloads from external services. This can mislead users into exposing system/network metadata or initiating unreviewed downloads when they believed the tool would remain offline.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Large portions of the skill are written in Chinese and line L0011 explicitly presents a Chinese-only maintenance statement, while the document does not offer users a language option or explain that the skill is intended only for a Chinese-speaking environment. This can violate language or locale policy when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.