T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_image.py:165- Finding
Unrestricted Download of Provider-Controlled URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
NSFW Image Generation — Unrestricted AI Image Models
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it advertises, but it uses a broad paid Atlas Cloud API key and downloads provider-returned URLs without validation, so it belongs in Review before installation.
Install only if you are comfortable sending prompts and any edited source images to Atlas Cloud and using an Atlas Cloud key that may bill your account. Use a dedicated low-balance key, avoid private or identifying images unless you intend to upload them, and treat downloaded outputs as untrusted files until the download validation issue is fixed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill requires environment access for an API key and performs network operations, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates an avoidable trust gap: an agent/runtime may grant broader capabilities than intended, making secret access and outbound transmission harder to constrain or audit.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example sends user prompts and the bearer API key to an external third-party service. While that is core to the skill's function, it is still a real data egress and credential-use surface: sensitive prompts or image-related data may leave the local environment, and misuse of the key could incur charges or expose account capabilities.
- Content
bash # Step 1: Submit curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
This example sends user prompts and the bearer API key to an external third-party service. While that is core to the skill's function, it is still a real data egress and credential-use surface: sensitive prompts or image-related data may leave the local environment, and misuse of the key could incur charges or expose account capabilities.
- Content
bash # Step 1: Submit curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 89% confidence
- Finding
Polling the external prediction endpoint continues transmitting the bearer credential to a third-party service and retrieves externally hosted output URLs. This expands the egress surface and can expose generated asset locations or metadata if the environment assumes local-only processing.
- Content
md # Returns: { "code": 200, "data": { "id": "prediction-id" } } # Step 2: Poll (every 3-5 seconds) curl -s "https://api.atlascloud.ai/api/v1/model/prediction/{prediction-id}" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" # Returns: { "code": 200, "data": { "status": "completed", "outputs": ["https://...url..."] } }
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 96% confidence
- Finding
The image-edit workflow uploads or references source images for remote processing, which can transmit potentially sensitive local image content to a third party. In context, this is more dangerous than text-only generation because users may unknowingly send private or identifying images off-device.
- Content
Image Editing Example (Wan 2.6)
bash curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This is another documented outbound request to the same third-party image-generation API, sending prompts and credentials externally. It is expected for the skill's purpose, but still represents a real confidentiality and billing-risk boundary that should be explicitly scoped and controlled.
- Content
Seedream Example
bash curl -s -X POST "https://api.atlascloud.ai/api/v1/model/generateImage" \ -H "Authorization: Bearer $ATLASCLOUD_API_KEY" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import urllib.error import urllib.parse API_BASE = "https://api.atlascloud.ai/api/v1" UA = "AtlasCloud-Skill/1.0"
Static analysis
No suspicious patterns detected.