Grok Image API

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:29 AM UTC
• Version: 1.1.1

Overview

The skill does what it claims, but its helper script gives remote or misconfigured endpoints too much control over where credentials, images, network requests, and downloaded files go.

Review before installing. Use only a trusted HTTPS API base URL, keep the API key scoped and revocable, avoid sending sensitive images or prompts, prefer `--keep-url` or a controlled output path when appropriate, and be aware that the helper may download and save remote content locally by default.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/grok_image_api.py:187

Finding

Bearer Credentials and Sensitive Image Data Can Be Sent to Untrusted or Plaintext Endpoints

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/grok_image_api.py:138

Finding

Automatic Download of Server-Controlled URLs Enables SSRF and Resource Exhaustion

Content

View full analysis

Path: out_path.parent.mkdir(parents=True, exist_ok=True) req = request.Request(url, headers={"User-Agent": "grok-image-api-skill/1.1.1"}) with request.urlopen(req) as resp: data = resp.read() content_type = resp.headers.get("Content-Type", "") if out_path.suffix.lower() not in {".png", ".jpg", ".jpeg", ".webp"}: if "jpeg" in content_type or url.lower().endswith((".jpg", ".jpeg")): out_path = out_path.with_suffix(".jpg") elif "webp" in content_type or url.lower().endswith(".webp"): out_path = out_path.with_suffix(".webp") else: out_path = out_path.with_suffix(".png") out_path.write_bytes(data) return out_path ``` The download is triggered by a URL controlled by the API response: ```python if item.get("url"): if download_url: final_path = download_to(item["url"], path) print(str(final_path)) else: print(item["url"]) return ``` ### Technical Analysis The API response can supply an arbitrary value in `data[0].url`. Because downloading is enabled by default, the script passes that value directly to `urllib.request.urlopen` without validating: - The URL scheme. - The hostname or resolved IP address. - Whether the target is a loopback, private, link-local, or reserved address. - Whether the host belongs to the configured API provider or an approved image CDN. - Redirect destinations. - The declared content type or actual image signature. - The maximum response size. This creates a server-side request forgery condition from the perspective of the machine running the Skill. A malicious or compromised ...[truncated 2630 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/grok_image_api.py (reported line 189)May include surrounding context.

python

def apply_style(prompt: str, style: str | None):
    if not style:
        return prompt
    return f"{prompt}, {STYLE_PRESETS[style]}"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs use of environment variables, local file reads/writes, and outbound network access, but it does not declare any tool scope or permission boundaries. This increases the chance an agent can use broader capabilities than the user expects, especially when handling local images and API credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs users to send prompts and, for edits, local image files and optional masks to a remote API endpoint, but it does not clearly warn that this data leaves the local environment. Users may unknowingly transmit sensitive prompts or images to third-party infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill says results should be saved locally and defaults to a local output directory, but the top-level description does not warn users that generated or edited images will be stored on disk. This can cause unintended retention of sensitive or private image content on the local machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill tells users to load API credentials from environment variables but does not explicitly warn that these values are sensitive secrets that must not be exposed in logs, outputs, or prompts. In practice, this can lead to accidental disclosure during debugging or user interaction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file applies to SQP-2, and it documents that a helper script will save returned images to a local output directory by default. The notes describe the behavior but do not warn users that files will be written locally or that remote URLs will be fetched and persisted unless --keep-url is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill downloads remote image content and writes it to a local output path, and also decodes base64 image data and saves it to disk. Although these writes are part of the tool's functionality, there is no confirmation prompt, warning, or explicit user-facing disclosure in the code about where files will be created by default.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.