Gemini Image Proxy

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:18 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward image generation/editing helper that uses a user-configured external API endpoint and does not show hidden, persistent, or destructive behavior.

Install only in an isolated Python environment, pin `openai` if reproducibility matters, and configure `GOOGLE_PROXY_BASE_URL` only to a trusted HTTPS proxy. Do not use this with confidential prompts or sensitive images unless that provider is approved for that data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md:34` **Vulnerability Type**: Unpinned dependency and insufficient supply-chain integrity controls **Risk Level**: Medium ### Technical Analysis The installation instructions install the `openai` package without a fixed version, lock file, integrity hash, or explicitly trusted package index: ```bash python3 -m pip install openai ``` Consequently, the dependency resolved during installation can change over time and can also be affected by the user's Python package-index configuration. The project does not provide a reproducible, reviewed dependency set or a mechanism for verifying the integrity of the downloaded artifact. This issue does not demonstrate that the current upstream package is malicious. However, it creates a supply-chain exposure if an upstream release or configured package repository is compromised. ### Attack Path 1. An attacker compromises the upstream dependency distribution channel, publishes a malicious package version through a repository trusted by the target, or influences the target's package-index configuration. 2. The victim follows the documented command without specifying a reviewed version or validating an artifact hash. 3. `pip` resolves and installs the attacker-controlled package or release. 4. Malicious behavior can run during package build or installation where applicable, or when `scripts/generate.py` imports `OpenAI` from the installed package. 5. The malicious dependency executes with the privileges of the user running the installation or script. ### Impact Assessment Successful exploitation could provide code execution under the invoking user's account. The resulting access may include files, environment variables, API credentials, and network resources available to that user. The code does not itself request elevated privileges, so this issue does not directly provide administrator or root access unless the victim runs the instal ...[truncated 38 chars]
• Remediation: ## Remediation Suggestions - Pin `openai` and its transitive dependencies to reviewed versions in a lock file. - Install dependencies with integrity verification, such as `pip install --require-hashes -r requirements.txt`. - Explicitly use a trusted package index and prevent unintended fallback to untrusted extra indexes. - Periodically review and update pinned dependencies using a controlled security-update process. - Run installation and execution as a nonprivileged user in an isolated virtual environment or container. - Document the exact supported dependency version rather than instructing users to install the latest available release.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.py:31
• Finding: API Credentials and User Content Can Be Sent to an Unrestricted Configurable Endpoint## Vulnerability Details **File Location**: `scripts/generate.py:31-64` **Vulnerability Type**: Missing endpoint scheme and destination validation **Risk Level**: Medium ### Technical Analysis The program accepts `GOOGLE_PROXY_BASE_URL` directly from the environment, removes only a trailing slash, and supplies it to the OpenAI client without requiring HTTPS or restricting the destination to an approved host. The client then uses the corresponding API key when transmitting prompts and, for edit operations, a local image: ```python def get_base_url(): """Get base URL from environment.""" return get_env_var("GOOGLE_PROXY_BASE_URL").rstrip("/") def generate_image(prompt, output_path, input_image_path=None): """Generate or edit an image using OpenAI Python SDK.""" api_key = get_api_key() base_url = get_base_url() client = OpenAI(api_key=api_key, base_url=base_url) if input_image_path: if not os.path.exists(input_image_path): print(f"Error: Input image not found: {input_image_path}", file=sys.stderr) sys.exit(1) with open(input_image_path, "rb") as image_file: response = client.images.edits( model=MODEL, prompt=prompt, image=image_file, response_format="b64_json", n=1, ) else: response = client.images.generate( model=MODEL, prompt=prompt, response_format="b64_json", n=1, ) ``` The network communication is part of the Skill's documented purpose and is not hidden exfiltration. Nevertheless, insufficient endpoint validation means that a malicious, mistyped, or insecurely configured URL may receive the API credential, prompt contents, and selected image data. A non-TLS URL may additionally expose traffic to interception, depending on SDK behavior and the netw ...[truncated 1563 chars]
• Remediation: ## Remediation Suggestions - Parse the configured endpoint with a standard URL parser and reject malformed URLs. - Require the `https` scheme and reject plaintext HTTP. - Maintain an explicit allowlist of trusted proxy hostnames and, where practical, approved ports and path prefixes. - Reject URLs containing embedded user information or unexpected URL components. - Keep TLS certificate verification enabled and do not permit insecure verification overrides. - Separate development endpoints from production configuration and require an explicit opt-in for nonproduction hosts. - Display the validated destination and request confirmation before uploading a local image when interactive use is possible. - Use narrowly scoped, revocable API keys with usage limits, and rotate a key immediately if it may have been sent to an untrusted endpoint. - Document that prompts and input images are transmitted to the configured external service.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key():
    """Get API key from environment."""
    return get_env_var("GOOGLE_PROXY_API_KEY")

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill requires sensitive environment variables for remote API access but does not declare an explicit tool scope such as permissions or allowed-tools. This weakens transparency and policy enforcement, making it easier for a host agent or user to invoke the skill without clearly understanding that secrets are required and may be used by code. In this context, the omission is more concerning because the skill is explicitly designed to send requests to an external service using an API key.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation instructs users to generate and edit images through a remote OpenAI-compatible endpoint but does not clearly warn that prompts and uploaded input images are transmitted off-box to a third-party API. Users may unknowingly send sensitive images, proprietary artwork, or confidential prompt content to an external service, creating privacy, compliance, and data-handling risks. The skill context increases the danger because image editing explicitly encourages uploading local files, which may contain sensitive visual information.

Static analysis

No suspicious patterns detected.