Security audit

Stable Diffusion

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a Stable Diffusion guide, but its copy-paste install commands are unsafe enough to require review before use.

Review and harden the installation steps before following them: enter the cloned project directory explicitly, use trusted pinned releases or commits where practical, install in a virtual environment or container, and avoid running these commands with elevated privileges.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:27
Finding: Unpinned Remote Repository Retrieval and Script Execution
Content: View full analysis
Remediation: View remediation
./webui.sh ``` - Run the application as a dedicated, unprivileged user and do not use `sudo` unless a specific, reviewed operation requires it. - Prefer a sandboxed container or virtual machine with restricted filesystem and network access. - Review the installation script and its transitive downloads before execution. - Document the expected repository owner, release version, commit hash, and verification procedure. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:31
Finding: Unpinned Third-Party Repository and Python Dependency Installation
Content: View full analysis
Remediation: View remediation
python3 -m venv .venv . .venv/bin/activate python -m pip install --upgrade pip python -m pip install --require-hashes -r requirements.lock ``` The referenced `requirements.lock` must be independently reviewed, use exact versions, and include valid hashes. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description and core instructional text are written entirely in Chinese and position the skill as operating in that language, without indicating that users may choose another language. This can violate language/locale policy when a skill imposes a specific language by default without user opt-in or documented justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.