Security audit

Crazyrouter Image Gen

Security checks for vulnerabilities and agentic risk

Overview

This image-generation skill is mostly purpose-aligned, but it has under-scoped network and credential handling that users should review before installing.

Install only if you are comfortable sending image prompts and settings to Crazyrouter and possibly underlying model providers. Use a limited-scope API key, avoid setting CRAZYROUTER_BASE_URL unless you fully trust the endpoint, choose a fresh output filename to avoid overwrites, and avoid sensitive prompts until the skill adds stronger URL validation, download limits, and overwrite protection.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.mjs:6
Finding: API Credential Disclosure Through an Unrestricted Base URL Override
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/main.mjs:54
Finding: Server-Side Request Forgery and Resource Exhaustion Through Unvalidated Image URLs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.mjs:17
Finding: Documented Image Count Limit Is Not Enforced
Content: View full analysis
` | Number of images (1-4) | `1` | ``` ### Technical Analysis The documented valid range for `--n` is 1 through 4, but the parser accepts any integer that produces a truthy result. Large positive numbers and negative numbers are forwarded directly to the external API. Only zero, missing values, and values parsed as `NaN` fall back to `1`. Relying exclusively on remote API validation creates inconsistent behavior and can expose the user to unnecessary cost or resource consumption if the service accepts values outside the documented range. The script also does not confirm that the number of returned images is bounded before downloading and writing each response item. ### Attack Path 1. A caller invokes the script with an excessive value, such as `--n 100000`. 2. `parseInt` accepts the value without checking the documented range. 3. The script places the value directly into the billable image-generation request. 4. If the remote API accepts or partially honors the request, it may generate an unexpectedly large workload or return many image entries. 5. The script iterates over every returned entry and downloads or decodes each result, increasing API usage and local resource consumption. ### Impact Assessment The primary impact is potential API quota consumption, unexpected billing, excessive network traffic, and local disk or memory pressure. The actual generation volume depends on server-side limits, so acceptance of an arbitrarily large image count is not established solely by the local code. This issue does not grant additional local ...[truncated 136 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger text is broad enough to activate on many ordinary requests to 'generate, create, or draw an image,' which can cause the agent to invoke this external integration more often than the user likely expects. In practice, overbroad routing increases the chance of unintended data disclosure to a third-party API and incorrect tool selection when a safer or more appropriate local capability exists.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill sends user prompts and request parameters to Crazyrouter, but the description does not clearly disclose that user data leaves the agent environment and is processed by an external service. This creates a meaningful privacy and trust risk because users may include sensitive text in prompts without realizing it will be transmitted to a third party.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script writes image data directly to a user-specified path using writeFile without checking whether the target already exists or warning before overwrite. In an agent/tooling context, a prompt or caller-controlled output path could unintentionally clobber existing user files, causing data loss or destructive modification of local files.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/main.mjs:7