Ultimate AI Media Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:48 AM UTC
• Version: 1.0.1

Overview

The skill mostly does the advertised CyberBara media-generation work, but its documented install path and runtime defaults deserve review before use.

Review and pin the installer and repository revision before installing. Prefer `CYBERBARA_API_KEY` or another secret manager over putting keys on the command line, protect or rotate any saved key, use `--no-open` unless you trust generated output files, and avoid the `raw` command unless you know exactly which CyberBara endpoint will be called.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: README.md:45
• Finding: Unpinned Package and Repository Execution During Installation<![CDATA[ ## Vulnerability Details **File Location**: `README.md:45-60` and equivalent instructions in `README-zh.md:44-59` **Vulnerability Type**: Unpinned third-party installer and mutable repository reference **Risk Level**: Medium ### Vulnerable Code Snippet ```text Help me install this skill, use command `npx skills add ZeroLu/Ultimate-AI-Media-Generator-Skill --all` ``` ```bash # List what can be installed from this repo npx skills add ZeroLu/Ultimate-AI-Media-Generator-Skill --list # Install all skills from this repo npx skills add ZeroLu/Ultimate-AI-Media-Generator-Skill --all # Optional: install for specific agents (if your skills runtime supports agent targeting) npx skills add ZeroLu/Ultimate-AI-Media-Generator-Skill --all -a codex -a claude-code ``` ### Technical Analysis The documented installation process invokes `npx skills` without pinning the `skills` package to a reviewed version or integrity value. Depending on the local npm environment, `npx` may retrieve and execute the current registry release of that package. The source repository is also identified only by `ZeroLu/Ultimate-AI-Media-Generator-Skill`, without a commit hash or immutable release tag. Consequently, both the installer implementation and installed repository contents may change after this Skill version has been audited. This is a supply-chain weakness rather than evidence that the current package contains malicious code. The reviewed Python source itself does not dynamically download or execute code. ### Attack Path 1. An attacker compromises the npm package used by `npx skills`, its maintainer account, or the referenced source repository. 2. The attacker publishes a modified package version or changes the mutable repository branch. 3. A user or AI agent follows the documented installation command. 4. `npx` retrieves and executes the modified installer, or the installer retrieves modified Skill content. 5. The malicious component executes with the permissions of the u ...[truncated 484 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installer to an explicitly reviewed version, for example using a version-qualified npm package reference. 2. Pin the Skill source to an immutable commit hash or signed release tag instead of a mutable repository branch. 3. Publish and verify package integrity hashes or signed release artifacts where supported. 4. Document the expected npm registry, package owner, repository URL, version, and commit identifier. 5. Avoid instructing an AI agent to execute installation commands without first presenting the exact package version and source for user approval. 6. Recommend running installation under a nonprivileged account and reviewing the package lifecycle scripts before execution. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: src/cyberbara_cli/usecases/media_output.py:57
• Finding: Untrusted Task Output Is Downloaded and Automatically Opened<![CDATA[ ## Vulnerability Details **File Location**: `src/cyberbara_cli/usecases/media_output.py:57-89`; automatic invocation at `src/cyberbara_cli/usecases/media_output.py:112-121` **Vulnerability Type**: Unvalidated remote file download followed by automatic handler invocation **Risk Level**: Medium ### Vulnerable Code Snippet ```python def _download_media_url(url: str, output_dir: Path) -> Path: req = request.Request( url=url, headers={"User-Agent": DEFAULT_HTTP_USER_AGENT}, method="GET", ) with request.urlopen(req, timeout=180) as resp: content = resp.read() content_type = resp.headers.get_content_type() if resp.headers else None ext = _guess_extension(url, content_type) timestamp = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S") filename = f"cyberbara_{timestamp}_{uuid.uuid4().hex[:8]}{ext}" file_path = output_dir / filename file_path.write_bytes(content) return file_path def _open_file(file_path: Path) -> None: try: if sys.platform.startswith("darwin"): subprocess.Popen(["open", str(file_path)]) return if os_name_is_windows(): subprocess.Popen(["cmd", "/c", "start", "", str(file_path)]) return xdg_open = shutil.which("xdg-open") if xdg_open: subprocess.Popen([xdg_open, str(file_path)]) return ``` The download and open operations are connected as follows: ```python saved_files: list[str] = [] for url in urls: path = _download_media_url(url, target_dir) saved_files.append(str(path)) print(f"[save] {path}", file=sys.stderr) if open_files: _open_file(path) ``` ### Technical Analysis Output URLs are obtained from the remote task response and supplied directly to `urllib.request.urlopen`. The implementation does not: - Restrict URLs to HTTPS. - Allowlist approved media CDN hosts. - Revalidate the destination aft ...[truncated 1945 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make automatic opening opt-in rather than enabled by default. 2. Require an explicit confirmation before opening each downloaded file. 3. Accept only `https` URLs and reject embedded credentials, fragments, and unsupported schemes. 4. Maintain a narrow allowlist of documented CyberBara media CDN hostnames. 5. Disable automatic redirects or validate the scheme, hostname, resolved address, and port after every redirect. 6. Reject loopback, link-local, private, multicast, and other special-purpose destination addresses. 7. Stream downloads in bounded chunks and enforce strict per-file and aggregate size limits. 8. Validate the response `Content-Type` against an allowlist, then verify file signatures independently of headers and URL extensions. 9. Generate extensions from verified content rather than trusting the URL suffix. 10. Consider scanning downloaded files before opening them and store them with restrictive permissions. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: src/cyberbara_cli/config.py:54
• Finding: API Keys Are Accepted Through Process Arguments and Echoed Interactive Input<![CDATA[ ## Vulnerability Details **File Location**: `src/cyberbara_cli/config.py:54-79` and `src/cyberbara_cli/config.py:92-124`; insecure command examples at `README.md:71,168` and `SKILL.md:66` **Vulnerability Type**: Local credential exposure through command history, process arguments, and terminal echo **Risk Level**: Low ### Vulnerable Code Snippet ```python def _prompt_and_cache_api_key() -> str: message = ( "API key not found. Visit " f"{API_KEY_PAGE_URL} to create one." ) if not sys.stdin.isatty(): raise SystemExit( f"{message} Then provide --api-key or set {API_KEY_ENV_VAR}." ) print(message, file=sys.stderr) entered = _normalize_api_key(input("Please paste your CyberBara API key: ")) if not entered: raise SystemExit("No API key provided.") save_cached_api_key(entered) print(f"API key saved to {API_KEY_STORE_PATH}.", file=sys.stderr) return entered def resolve_api_key(cli_api_key: str | None) -> str: key_from_arg = _normalize_api_key(cli_api_key) if key_from_arg: save_cached_api_key(key_from_arg) return key_from_arg ``` The setup flow uses the same echoed input mechanism: ```python elif sys.stdin.isatty(): print( f"Visit {API_KEY_PAGE_URL} to create one.", file=sys.stderr, ) key = _normalize_api_key(input("Please paste your CyberBara API key: ")) if not key: raise SystemExit("No API key provided.") source = "interactive_prompt" ``` The documentation recommends placing the secret directly in the command: ```bash python3 scripts/cyberbara_api.py setup-api-key "<your_api_key>" ``` ### Technical Analysis API keys supplied as positional or `--api-key` arguments can be retained in shell history. On some systems, process command lines are also observable through process-monitoring interfaces or administrative tooling while the command is running. Interacti ...[truncated 1666 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `input()` with `getpass.getpass()` for all interactive API-key prompts. 2. Stop recommending secrets in positional or named command-line arguments. 3. Prefer an OS credential manager or keyring instead of a plaintext configuration file. 4. Support reading the key from standard input or a protected file descriptor for automation. 5. Separate key use from key persistence: require an explicit `--save-api-key` action before caching a key supplied for one command. 6. Create the credential file atomically with restrictive permissions rather than writing first and applying `chmod` afterward. 7. Fail securely, or at least prominently warn the user, if restrictive file or directory permissions cannot be applied. 8. Document shell-history and environment-variable exposure risks and recommend rotating any key that may have been exposed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (35)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: Based on the provided code chunk alone, the implementation shown does not substantiate the declared purpose. The code simply prepares Python import paths and delegates execution to another module. While the missing imported module could potentially implement the declared features, this chunk itself is a generic CLI launcher and does not accurately represent the rich AI media-generation behavior described. Therefore the description does not accurately match the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear mismatch because the declared description claims a full-featured AI image/video generation skill with multiple workflows and auxiliary features, while the provided code chunk contains only an empty package initializer with a docstring. No functional behavior supporting the declared purpose is present in this snippet. Based on the supplied code alone, the actual behavior is effectively just package declaration/metadata, which is materially different from the stated purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description focuses on media generation capabilities such as text-to-image, text-to-video, prompt optimization, credit estimation, polling, and media handling. None of those behaviors appear in this code chunk. Instead, the code is solely a configuration/credential helper for obtaining and caching an API key in the user's home directory. This is a materially different purpose from the declared user-facing functionality, so the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full-featured AI image/video generation skill. However, the supplied code chunk is only a minimal __init__.py file that imports and exposes CyberbaraClient. Based on this chunk alone, none of the advertised functionality is implemented or evidenced. This is a material mismatch between the declared purpose and the actual visible behavior of the provided code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full-featured AI image/video generation skill, but the supplied code chunk contains only generic CLI output utilities for JSON formatting and error printing. It does not interact with any AI models, media generation APIs, prompt optimization logic, polling mechanisms, or credit estimation. This is a materially different purpose, so the description does not accurately represent the behavior of the provided code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full-featured AI image/video generation skill with multiple generation modes and operational features. The actual code chunk does not perform any media generation, model invocation, prompt optimization, polling, output handling, or estimation logic. It is a generic payload parsing utility for command-line JSON input. This is a materially different primary purpose from the declared description, so it should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a full-featured generative media skill, but the provided code chunk does not implement any of those capabilities. It is only an empty package initializer for runtime behavior guard policies. This is a materially different purpose, so the description does not accurately represent the actual code shown.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: There is a clear mismatch between the declared description and the provided code. The description claims substantial functionality related to AI media generation and workflow orchestration, but the actual code chunk is only an empty package initializer with a docstring (`"Use cases package."`). It contains no operational logic and does not demonstrate any of the declared capabilities. Based on this supplied chunk alone, the description does not accurately represent the code's behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README tells users to run `npx skills add ...` without pinning a specific package version or commit. This allows whatever the latest published `skills` package resolves to at execution time, creating a supply-chain risk where a compromised or malicious upstream release could execute arbitrary code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This installation command uses `npx skills` without any version pinning. If the referenced package or its dependencies are hijacked or updated maliciously, users following the README may execute attacker-controlled code on their system.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README again instructs use of an unpinned `npx skills` command, which is a real supply-chain exposure. Because this is an install path for an agent skill, the command may be run in trusted development environments where arbitrary package execution has meaningful impact.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This command continues the same pattern of invoking `npx skills` without pinning a version. In practice, this exposes users to registry compromise, typosquatting, or malicious future releases that could run code at install time.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The agent-specific installation example still depends on an unpinned `npx skills` invocation. The surrounding skill context increases risk because users are explicitly encouraged to paste the command into AI-assisted environments, reducing scrutiny over what will be executed.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README instructs users to persist an API key to `~/.config/cyberbara/api_key` but does not warn about local secret exposure, permissions, shell history leakage, or shared-machine risks. In an agent/developer-tool context, storing long-lived credentials without security guidance can lead to credential theft and unauthorized API usage.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The phrase 'Help me install this skill, use command ...' is broad natural-language text designed to be pasted into an agent chat, and it overlaps with ordinary user phrasing. In a skill ecosystem, broad trigger/install phrasing can cause accidental invocation or socially engineer users into delegating installation and code execution to an agent without sufficient review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to run `npx skills add ...` without pinning a specific package version or commit. That causes installation and execution to depend on whatever package/version is current at runtime, creating a supply-chain risk if the package is updated maliciously or a compromised release is published.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This command references `npx skills` without version pinning, so users may install or execute a different artifact over time than the author reviewed. In a skill ecosystem, that can directly expose agents and developer environments to unreviewed code execution through a mutable dependency path.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Using `npx skills` here without a pinned version leaves the install path vulnerable to upstream package substitution or compromised future releases. Because the command is part of the documented installation flow, users are likely to copy-paste it directly, amplifying the supply-chain exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README again promotes execution of an unpinned `npx skills` command, which can fetch mutable code at install time. Since this is framed as the primary install path, the skill context makes the issue more dangerous because it encourages agent-assisted installation of code from a changing trust boundary.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This install example still relies on unpinned `npx skills`, so the exact code executed is not stable or auditable over time. That creates a realistic supply-chain attack surface, especially for users who install for multiple agents and may grant broader integration access.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README states that the API key is stored at `~/.config/cyberbara/api_key` but does not clearly warn about the security implications of writing long-lived credentials to disk. In agent-enabled environments or shared systems, disk-stored secrets may be exposed through weak file permissions, backups, logs, or unintended workspace access.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Star History

[![Star History Chart](https://api.star-history.com/svg?repos=ZeroLu/Ultimate-AI-Media-Generator-Skill&type=Date)](https://star-history.com/#ZeroLu/Ultimate-AI-Media-Generator-Skill&Date)

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Star History

[![Star History Chart](https://api.star-history.com/svg?repos=ZeroLu/Ultimate-AI-Media-Generator-Skill&type=Date)](https://star-history.com/#ZeroLu/Ultimate-AI-Media-Generator-Skill&Date)

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documentation describes capabilities that require sensitive operations including environment access, filesystem reads/writes, network access, and shell execution, but it declares no explicit tool scope or permission boundaries. In an agent environment, that omission can cause over-broad default execution authority, increasing the risk of unintended credential access, local file modification, or arbitrary command execution when the skill is invoked.

Session Persistence

Medium

• Category: Rogue Agent

Content

This skill automatically optimizes prompts for specific use cases to achieve the best results:

- **SEO Articles** — Generate featured images and illustrations optimized for blog posts and articles
- **Presentations/Slides** — Create professional visuals for PowerPoint, Keynote, and Google Slides
- **Anime/Manga** — Generate anime-style artwork with optimized prompts for consistent style
- **Product Photography** — Create product shots with proper lighting and composition
- **Social Media** — Generate platform-optimized visuals for Instagram, TikTok, YouTube

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.