T09 · Insecure Skill Coding Practices
Warning
- Location
docs/architecture.md:238- Finding
API Keys Are Collected Through Chat and Persisted in Plaintext Configuration Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Easy Image
Security checks for vulnerabilities and agentic risk
Overview
This image skill is not clearly malicious, but it needs review because it asks for API keys in chat, stores them in local config files, and sends or reuses workplace prompts by default.
Review this before installing in a work environment. Use a dedicated secret mechanism or environment variables instead of pasting API keys into chat, avoid confidential customer or product details unless your organization permits those provider/search data flows, turn off grounding/search when not needed, and periodically inspect or delete the saved prompt library and local config files.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (61)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill says grounding should be on by default but does not warn that prompts may be transmitted to external web/image search services. Because this skill is marketed for workplace use, prompts may contain confidential marketing plans, product concepts, or internal brand assets, making silent external transmission a significant privacy and data-governance issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The README describes automatic translation of simple descriptions into professional prompts, and all examples show English prompt output regardless of the user's original language. This suggests a language policy constraint that is not presented as optional or user-configurable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README says web search is enabled by default and will automatically search for brands, characters, and style references, but it does not clearly warn that user prompts and derived queries may be transmitted to external services. In a workplace image-generation context, prompts may contain confidential product plans, marketing concepts, or customer information, so silent default exfiltration to third parties creates a real privacy and data-governance risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises automatic saving of successful prompts to ~/.easy-image-skill/my-prompts.md without an explicit warning about persistent local storage. Prompts can contain proprietary campaign ideas, internal product names, or personal data, and silent retention increases the risk of unintended disclosure to other local users, backups, endpoint monitoring tools, or later reuse without the user's awareness.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The setup instructions explicitly tell users to provide an API key in plain conversation ('my key is sk-xxx'), which encourages secret disclosure through a chat channel that may be logged, stored, or exposed to the model/runtime. This is especially dangerous in enterprise settings because API keys can grant billable access to third-party services and may enable broader account compromise depending on provider permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow says the skill will call external image generation APIs, but it does not clearly warn users that their prompts, and potentially sensitive business content, will be transmitted to third-party providers. In a workplace-oriented image skill, this creates meaningful confidentiality and privacy risk because prompts may contain product, marketing, or internal presentation details.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly performs automatic downloads and writes generated files to a user-selected path under a so-called blanket authorization, but the skill description does not provide a prominent warning at invocation time. This is dangerous because users may not realize a simple image request causes filesystem writes, which can lead to unwanted file persistence, clutter, or misuse of trusted directories.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The config command examples are short, generic phrases like "show config" and "reset config" that overlap with normal conversation and can be triggered unintentionally or via prompt content quoted from other sources. In a skill that changes settings and stores keys/paths, broad invocation increases the chance of accidental configuration disclosure or modification without clear user intent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The schema encodes a China-region provider as the default while also listing global alternatives, but provides no documented opt-in, locale gating, or consent mechanism. Because this skill is designed for professional workplace use, prompts may contain sensitive commercial content, making silent cross-region routing more security- and compliance-relevant than in a purely consumer toy context.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The schema sets a default provider of "jiekou" without requiring explicit user choice, which can silently route image-generation requests to a region-specific third party. In a workplace-oriented image skill, this can create unintended data-transfer, compliance, or privacy exposure if prompts or embedded business details are sent to a provider the user did not knowingly select.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Silently reusing content from the user's personal prompt library can disclose prior private or sensitive prompt material into new generations or external API requests without the user's awareness. Because the reuse is similarity-based and automatic, users may not realize historical content is influencing outputs or being sent off-device.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest presents the skill as a professional image generation assistant that turns simple descriptions into high-quality images. This architecture adds a separate capability to trigger web and image search grounding and send those search tools to external APIs, which is not mentioned in the stated purpose and is not strictly required for basic image generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The architecture sends user-derived prompt content to third-party APIs and may trigger web/image search without an explicit warning or consent gate. This creates a privacy risk because requests can contain proprietary product plans, internal campaign details, or sensitive personal content that users may assume stays local.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The documented flow includes reading API keys from ~/.{platform}/config.json in addition to the skill's own config. For a skill described only as an image generation assistant, accessing external credential stores is a broader capability that should be explicitly disclosed rather than implied.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The examples instruct users to paste raw API keys directly into chat using patterns like 'my key is ...' without any warning about secrets handling, masking, retention, or secure storage. In an agent/chat context, this can expose credentials in logs, transcripts, analytics, screenshots, or downstream tools, enabling account takeover or billed API abuse if the key is leaked.
- Content
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Indirect Prompt Extraction
Medium
- Category
- System Prompt Leakage
- Confidence
- 75% confidence
- Finding
Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.
- Content
md - Identify elements: color=blue, style=tech, theme=AI - Check personal library: no match - Load template: references/templates/ppt-slides.md - Translate prompt: modern AI presentation cover, deep blue gradient background (#0a1929 to #1565c0), futuristic geometric patterns, neural network visualization elements, minimalist tech aesthetic, professional corporate style, clean composition, high resolution, 16:9 aspect ratio - Call Jiekou AI API
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The examples normalize automatic saving to local paths and reuse in a 'personal library' without an upfront privacy notice or clear consent model for retention and similarity matching. This can unintentionally persist sensitive prompts, generated business materials, or style/history metadata, which is risky in workplace environments where content may be confidential.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file explicitly instructs the system to default to web-search grounding for most prompts, using broad triggers like named entities, style references, and unclear terms. In an image-generation skill, this can cause unnecessary disclosure of user prompts to external search tools and expand the attack surface through over-collection and unintended third-party processing.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The decision flow makes grounding the fallback for 'any named entity, character, brand, style, or unclear term,' which is overly vague and likely to activate web search for ordinary prompts. This broad routing increases privacy risk and can cause user content, including proprietary workplace material, to be sent externally without necessity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The sample configuration sets enable_grounding to true by default, which can cause external data retrieval and transmission without an explicit user-facing notice or consent mechanism. Because this skill is intended for professional workplace use, default-on grounding increases the chance that sensitive business prompts or images are shared externally when users may expect local or direct model-only processing.
- Content
Static analysis
No suspicious patterns detected.