Yummy Gen Image

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.1.0

Overview

This skill is a coherent Gemini image-generation helper, with privacy and dependency-supply-chain caveats users should understand before use.

Install this only if you are comfortable using a third-party npm CLI and sending prompts and any reference images to Gemini through that tool. Avoid using confidential or regulated images unless you have approval, and prefer a sandboxed environment with only the required GEMINI_API_KEY exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: node
    package: "@yummysource/yummycli"
    bins: ["yummycli"]

Technical Analysis

The skill installs and executes the third-party npm package @yummysource/yummycli without specifying an exact version or integrity digest. Consequently, installation may resolve to a package release that was not reviewed as part of this audit.

If the package publisher, registry account, distribution infrastructure, or package namespace is compromised, an attacker could publish a malicious release. Package installation can also invoke npm lifecycle scripts, while later calls to the installed yummycli executable run package-controlled code with the invoking user's privileges.

This finding concerns dependency pinning and provenance. The reviewed file does not itself prove that the current package is malicious.

Attack Path

1. An attacker compromises the package publisher, registry account, namespace, or package distribution process.
2. The attacker publishes a malicious version of @yummysource/yummycli.
3. A user installs this skill's dependency without an exact version constraint or verified integrity digest.
4. The package manager resolves and downloads the attacker-controlled release.
5. Malicious code runs through an installation lifecycle script or when the agent invokes yummycli.
6. The code accesses resources available to the invoking account and may exfiltrate data, tamper with files, or execute additional commands.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account installing or invoking the CLI. Accessible resources may include project files, local reference images supplied for editing, environment variables such as GEMINI_API_KEY, and other ...[truncated 293 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @yummysource/yummycli to a reviewed exact version rather than allowing unconstrained resolution.
• Record and verify the package's registry integrity hash or equivalent immutable digest.
• Use a lockfile where supported and include it in the reviewed artifact.
• Verify package provenance, publisher identity, and registry source before installation.
• Review package contents and lifecycle scripts for every dependency update.
• Disable npm lifecycle scripts during installation where they are unnecessary and operationally feasible.
• Run installation and image-generation commands in a sandbox with minimal filesystem access, restricted network access, and only the required environment variables.
• Avoid exposing unrelated credentials to the CLI process, and rotate GEMINI_API_KEY if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs users to send prompts and local reference images to yummycli/Gemini but does not warn that this content leaves the local environment and is transmitted to an external third-party service. In an agent setting, users may provide sensitive images, proprietary artwork, or confidential text without realizing it will be uploaded, creating privacy, confidentiality, and compliance risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.