FLUX.2-pro Image Generation

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:46 PM UTC
• Version: 1.1.0

Overview

This skill is a coherent image-generation helper that sends prompts to a configured FLUX/Azure endpoint, with no hidden persistence or unrelated behavior found.

Install only if you intend to use a third-party FLUX/Azure image service. Do not include secrets, private data, or regulated information in prompts, and set FLUX_ENDPOINT only to your trusted Azure AI Foundry endpoint because the script sends FLUX_API_KEY to that URL. Consider pinning optional npm dependencies if using the Canvas overlay path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate.mjs:32

Finding

Unrestricted Endpoint Allows API Credential Exfiltration and Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: scripts/generate.mjs, lines 32–58
Vulnerability Type: Unvalidated outbound request destination and credential forwarding
Risk Level: Medium

Vulnerable Code

javascript

const endpoint = env.FLUX_ENDPOINT;
const apiKey = env.FLUX_API_KEY;

if (!endpoint || !apiKey) {
  console.error("Error: Set FLUX_ENDPOINT and FLUX_API_KEY environment variables");
  exit(1);
}
if (!args.prompt) {
  console.error("Error: --prompt is required");
  exit(1);
}

const body = {
  prompt: args.prompt,
  width: args.width || 1024,
  height: args.height || 1024,
  n: 1,
  model: "FLUX.2-pro",
};
if (args.seed !== undefined) body.seed = args.seed;

console.error(`Generating: "${args.prompt}" (${body.width}x${body.height})...`);

const res = await fetch(endpoint, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Authorization: `Bearer ${apiKey}`,
  },

Technical Analysis

The script obtains the destination URL directly from the FLUX_ENDPOINT environment variable and uses it without parsing or validating it. It does not require HTTPS, verify that the hostname belongs to Azure AI Foundry, reject embedded URL credentials, or restrict requests to an explicit allowlist.

The request includes FLUX_API_KEY in the Authorization header. Consequently, the bearer credential and image-generation prompt are transmitted to any destination selected through FLUX_ENDPOINT. This creates a credential-forwarding vulnerability when an attacker can influence the skill configuration, deployment environment, shell profile, or process environment.

The same behavior can be used as a server-side request forgery primitive. The script may issue a POST request to loopback, private-network, link-local, or other internal addresses reachable from the agent environment. Although the fixed JSON request format limits arbitrary interaction, the request ...[truncated 1730 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse FLUX_ENDPOINT with the standard URL class before making any request.
2. Require the https: protocol and reject plaintext HTTP or unsupported schemes.
3. Enforce an explicit allowlist of trusted Azure AI Foundry hostnames. Do not rely on substring or suffix checks that can accept deceptive domains.
4. Verify the expected endpoint path and API version where practical.
5. Reject URLs containing a username, password, unexpected port, fragment, or other unnecessary components.
6. Resolve and reject loopback, link-local, private, and reserved network destinations if custom hosts must be supported.
7. Keep the API key scoped to only the required Azure resource and rotate it if it may have been exposed.
8. Apply outbound network controls so the runtime can communicate only with approved Azure endpoints.
9. Document that FLUX_ENDPOINT is security-sensitive configuration and must not be influenced by untrusted users.

A basic validation pattern should resemble:

javascript

const endpointUrl = new URL(env.FLUX_ENDPOINT);
const allowedHosts = new Set([
  "expected-resource.services.ai.azure.com",
]);

if (
  endpointUrl.protocol !== "https:" ||
  !allowedHosts.has(endpointUrl.hostname) ||
  endpointUrl.username ||
  endpointUrl.password
) {
  throw new Error("Untrusted FLUX endpoint");
}

T08 · Insecure Dependencies

Note

• Location: SKILL.md:60

Finding

Unpinned Optional Dependency Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 60
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

text

Requires: `npm install canvas` + a CJK font file (e.g., NotoSansCJK-Bold.otf).

Technical Analysis

The setup documentation instructs users to install canvas without specifying an exact reviewed version. The project does not provide a package manifest or lockfile in the audited directory. As a result, the installed dependency version and transitive dependency graph can change over time without any corresponding change to the reviewed skill package.

npm packages may execute lifecycle scripts during installation. If a future package release or one of its transitive dependencies is compromised, users following the documented command could execute unreviewed code in the context of their local account. This finding does not establish that the current canvas package is malicious; it identifies a non-reproducible and insufficiently controlled dependency-installation practice.

Attack Path

1. A future release of the named package or a transitive dependency becomes compromised, malicious, or unexpectedly unsafe.
2. A user follows the documented npm install canvas instruction.
3. npm resolves the dependency to the then-current version rather than a version reviewed with this skill.
4. npm downloads the changed dependency graph and may run package lifecycle scripts.
5. Malicious installation code executes with the permissions of the user running npm.

Impact Assessment

Exploitation could execute arbitrary code with the privileges of the account performing the installation. That code could access files, environment variables, developer credentials, or network resources available to that account.

The practical risk is reduced because this dependency is optional, the installation command is documented rather than automatically execut ...[truncated 179 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed package.json and pin canvas to an exact version rather than a floating version range.
2. Commit a lockfile containing resolved versions and integrity hashes.
3. Instruct users to install dependencies with npm ci from the reviewed lockfile.
4. Review the package and its transitive dependency graph before updating the pinned version.
5. Use automated dependency and integrity scanning in the release process.
6. Where feasible, install with lifecycle scripts disabled and explicitly enable only scripts known to be required:

bash

npm ci --ignore-scripts

7. If native installation scripts are required by canvas, document that requirement and perform installation in an isolated, least-privileged environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

When the script isn't suitable, call the API directly:

bash

curl -s -X POST "$FLUX_ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $FLUX_API_KEY" \
  -d '{"prompt":"a cat","width":1024,"height":1024,"n":1,"model":"FLUX.2-pro"}' \

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents network-capable behavior and use of external credentials, but it does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent invokes network operations without clear authorization controls or review, which is risky in a skill that sends user prompts to a third-party service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description uses broad trigger language such as 'create, generate, or produce images' and 'visual content,' which can cause overly eager invocation in ambiguous contexts. Over-broad routing increases the chance of unintended use, including sending sensitive user prompts to the external image API when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The markdown instructs sending prompts and parameters to an external API but does not clearly warn users that their input will leave the local environment. This can lead to inadvertent disclosure of sensitive data embedded in prompts, especially because the skill is designed to handle arbitrary user-supplied creative text.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The skill explicitly performs external transmission of user prompts to a remote image-generation endpoint using an API key. In context this is the intended functionality, but it is still a real data-exposure risk because any sensitive text included in prompts will be sent off-box to a third-party service.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

When the script isn't suitable, call the API directly:

bash

curl -s -X POST "$FLUX_ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $FLUX_API_KEY" \
  -d '{"prompt":"a cat","width":1024,"height":1024,"n":1,"model":"FLUX.2-pro"}' \

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The best-practices section states "Prompt in English," which directs users toward a specific language choice. This can conflict with language/locale policy unless framed as an optional recommendation or accompanied by user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The line states that Chinese text rendering is not supported and instructs users to use a Canvas overlay, which imposes a language-specific constraint in the documentation. This is a natural-language locale policy concern because it singles out one language limitation without offering a broader user choice or opt-in framing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.