Compress Image

• Outcome: Review
• Latest audit: May 28, 2026 · 7:17 AM UTC
• Version: 9.0.3

Overview

The normal compression command appears local, but the package also contains undisclosed image-generation code that can use APIs, credentials, network calls, and persistent config.

Treat this as a Review install. The advertised compression path appears to use local tools, but the package is not cleanly scoped: avoid invoking scripts under scripts/vendor unless you intentionally want WeryAI image-generation behavior, and do not provide API keys or allow network access unless the publisher explains why those files are included or ships a compression-only version.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (39)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill declares itself as a local image compression wrapper, yet the analysis detected environment and network capabilities despite the manifest claiming no such permissions. In a skill that users may trust to process local files only, undeclared access to env and network materially increases the risk of secret exposure, remote data transfer, or unexpected external actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: This is a severe description-behavior mismatch: the skill claims to only compress or convert existing images, but the detected behavior includes remote image generation, polling external APIs, downloading results, querying account data, and loading API keys/configuration. That gap is dangerous because it can trick a user or orchestrator into granting trust to a seemingly harmless local utility while it performs unrelated networked operations and accesses secrets.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: This file is materially misaligned with the declared skill purpose: instead of image compression/conversion, it instructs the agent to bootstrap an image-generation environment, discover models, configure defaults, and manage generation prerequisites. In a compression skill, this expands scope into unrelated privileged actions, increasing the risk of unnecessary installs, configuration drift, and secret-handling for functionality the user did not request.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions explicitly direct the agent to participate in API-key configuration and persistence for image generation, which is unjustified for an image-compression skill. This creates an unnecessary secret-management path and could cause the agent to write sensitive credentials to disk or alter project configuration under a misleading skill context.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The title and early setup flow are plainly for image generation, not compression/conversion, indicating the wrong operational guidance has been embedded in this skill. That mismatch makes the skill more dangerous because users invoking a low-risk media-processing task may unknowingly trigger higher-risk environment setup and credential workflows.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script invokes `npm install` in discovered subdirectories via `spawnSync`, which executes package lifecycle scripts and fetches untrusted code from registries. In an image compression skill, this is unrelated functionality and creates a supply-chain/code-execution path if the bootstrap script is run on a compromised or unexpected package tree.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The file recursively discovers every `package.json` under the suite and installs dependencies for each package with nonzero dependency counts. That broad package discovery and installation behavior is not necessary for compressing or converting images, so it expands the attack surface and could trigger unintended dependency execution in nested or malicious directories.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This script performs model discovery against remote WeryAI documentation and generates a registry, which is outside the declared scope of an image compression/conversion skill. In a least-privilege review, this is dangerous because it introduces undeclared network and content-ingestion behavior that could be abused for capability creep, supply-chain drift, or unexpected data flows during build or execution.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code makes outbound requests to third-party documentation endpoints to fetch model data, which is not justified by the skill's stated purpose of compressing or converting images. Even though the URLs are hardcoded, this expands the attack surface by introducing network dependency, remote content trust, and the possibility of manipulated upstream docs influencing local behavior or build artifacts.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The doctor flow for a compression skill performs broad readiness assessment for image-generation features, including API-key/default-model/model-registry checks and setup guidance that are unrelated to local image compression. In a least-privilege context, this expands the skill’s visibility into project configuration and encourages unnecessary setup actions, increasing attack surface and creating unnecessary access to sensitive generation-related state.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script inspects .image-skills configuration and reads the project .env file to determine whether IMAGE_GEN_API_KEY is present, even though compression does not require image-generation credentials. Reading credential-bearing files for an unrelated skill violates least privilege and creates unnecessary exposure of secrets metadata and file contents if the script is modified, logged, or reused elsewhere.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The doctor script executes multiple external commands such as npm, npx, bun, and runtime/version probes that are not required to validate local image compression capability. Even though arguments are fixed, invoking extra executables based on PATH increases attack surface and can trigger unexpected code execution if a malicious binary is present earlier in PATH or if package-manager shims are compromised.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script writes a new project-level configuration file under `.image-skills/<namespace>/EXTEND.md` based on the caller-supplied `projectDir`, even though the skill is described as image compression/conversion. That creates persistent side effects outside the narrow skill scope and could modify an arbitrary directory if this helper is invoked with an unexpected project path, making the skill more powerful than its manifest suggests.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The script automatically runs doctor/bootstrap routines and may install or initialize dependencies when readiness checks find missing targets. For a compression skill, this broad environment-management behavior expands the attack surface and can trigger filesystem changes unrelated to the user’s requested image operation, especially because it happens automatically during readiness flow.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file is clearly an image-generation client for a third-party API, including submission, polling, and result download, which materially contradicts the declared skill purpose of image compression/conversion. In an agent skill, this mismatch is dangerous because a user invoking a local, low-risk operation may instead send prompts, reference images, and metadata to an external service.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Enabling use_web_search allows external data retrieval to influence prompts or generation behavior, which is unrelated to image compression and expands the skill's network and privacy surface. In this skill context, that feature makes unintended outbound requests and data exposure more likely, especially because users would not expect a compressor to browse or augment content from the web.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Webhook support introduces asynchronous external callbacks and possible exfiltration or workflow-triggering behavior that is unnecessary for image compression/conversion. In a mislabeled skill, this is particularly risky because it adds hidden remote interaction paths that users and operators would not expect from a simple file-processing tool.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The module docstring explicitly states it is a 'Single-gateway image generation CLI,' confirming intentional behavior that conflicts with the published compress-image skill intent. This deceptive or at least badly mislabeled functionality increases the chance that sensitive prompts, local images, or project data are sent off-box under false assumptions about what the skill does.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file implements image-generation model selection logic inside a skill whose declared purpose is image compression/conversion. That capability mismatch expands the skill's effective behavior beyond user expectations and can route execution toward model discovery, registry parsing, and generation-oriented decision paths that are unrelated to compression. In a compression skill, hidden generation-selection logic is especially risky because it can trigger unauthorized external dependencies or unintended processing flows.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The code falls back to auto-discovering image models from external WeryAI documentation when no local registry is present. For a compression/conversion skill, introducing network-oriented discovery creates an unnecessary external trust boundary and can leak environment context or enable behavior changes based on remote content. The mismatch with declared skill purpose makes this more dangerous because callers would not reasonably expect outbound discovery in a local image-processing utility.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file is a setup/bootstrap script for an image-generation subsystem, not an image-compression utility. In the context of a skill advertised as 'compress-image', bundling generation-focused setup logic materially expands the skill’s permissions and attack surface, including environment configuration, model registry creation, and execution of auxiliary generation code via dynamic import.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads, resolves, and writes IMAGE_GEN_API_KEY into local or home-scoped .env files and manages generation model configuration, which is unjustified for an image-compression skill. This creates unnecessary credential-handling behavior and persistent secret storage in a context where users would not reasonably expect generation-service access or secret propagation.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script invokes an external package runner via `npx -y bun` and also consumes environment configuration to select a model. That adds execution and dependency-fetching behavior unrelated to a compress-image skill, increasing supply-chain and unexpected-command risk if this script is present or run in the skill pipeline.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file performs image-generation smoke testing by calling `scripts/main.ts` with generation-oriented arguments such as `--prompt`, `--model`, and `--dry-run`, which is outside the stated purpose of an image compression/conversion skill. The mismatch is dangerous because it expands the skill's operational scope and may trigger unintended execution paths, hidden capabilities, or model/tool access not expected by reviewers or users.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This file implements remote balance retrieval from an external API, which does not align with the advertised image compression/conversion purpose of the skill. In a user-facing media-processing skill, hidden account/billing queries expand data exposure and create a deceptive capability mismatch that could enable unauthorized account reconnaissance or covert telemetry.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/doctor.mjs:34

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/main.ts:156

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/main.ts:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/run-generate.mjs:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:6