Security audit

Compress Image

Security checks for vulnerabilities and agentic risk

Overview

The advertised compressor is mostly local, but the package also bundles undisclosed image-generation code that can handle API keys and send prompts or images to WeryAI.

Review this package before installing as a compression-only skill. The documented compressor may be useful, but the artifact should remove or clearly separate the bundled WeryAI image-generation runtime, avoid persisting API keys from this package, pin or vendor its runtime dependencies, and fix the same-extension overwrite behavior before it is treated as a low-risk local compressor.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: package.json:9
Finding: Unpinned Remote Package Execution Through npx
Content: View full analysis
` or `npm test`. 2. npm invokes `npx -y bun`. 3. `npx` resolves `bun` using the current npm registry and configuration. 4. If the package is absent from the local cache, it is downloaded without an interactive confirmation. 5. Package-controlled code executes with the same operating-system permissions as the Agent. 6. A compromised registry package, publisher account, registry mirror, or dependency-resolution path could therefore execute arbitrary local code. ### Impact Assessment Successful exploitation provides code execution under the account running the Skill. Depending on ...[truncated 461 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/vendor/shared-image-generation/scripts/main.ts:183
Finding: Bearer Credential Forwarding to Unvalidated Image Result URLs
Content: View full analysis
{ ``` ### Technical Analysis The download routine initially requests a gateway-provided image URL without authentication. It then retries the same URL with the `IMAGE_GEN_API_KEY` bearer token after an HTTP `401` or `403`. It can also proceed to the authenticated attempt after an unauthenticated network exception. No hostname allowlist, origin comparison, or gateway-domain validation is applied before attaching the authorization header. HTTPS alone would not be sufficient because an attacker-controlled HTTPS server can still receive the token. The URL originates from image-generation task results. A compromised gateway, malicious API response, upstream service error, or response-manipulation condition could cause that result to point to an attacker-controlled domain. Although this code is not invoked by the normal root compression command, it ...[truncated 1229 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/vendor/shared-image-generation/scripts/main.ts:55
Finding: Undeclared Credential-Reading and Image-Upload Runtime Bundled with a Local Compression Skill
Content: View full analysis
\` from the ${SKILL_LABEL} skill directory. Doctor is read-only: it prints readiness, exact next commands, and does not create files.` ); process.exit(1); } return k.trim(); } ``` Authenticated external request: ```ts async function apiPost(pathSuffix: string, body: Record): Promise> { const res = await fetch(`${BASE_URL}${pathSuffix}`, { method: "POST", headers: { Authorization: `Bearer ${getApiKey()}`, "Content-Type": "application/json", }, body: JSON.stringify(body), }); const json = (await res.json()) as ApiEnvelope; if (!res.ok) { const msg = json?.message ?? json?.desc ?? res.statusText; throw new Error(`HTTP ${res.status}: ${msg}`); } if (!isApiSuccess(json)) throw weryaiBusinessError(json); return json; } async function apiGet(pathSuffix: string): Promise> { const res = await fetch(`${BASE_URL}${pathSuffix}`, { headers: { Authorization: `Bearer ${getApiKey()}` }, }); const json = (await res.json()) as ApiEnvelope; if (!res.ok) { const msg = json?.message ?? json?.desc ?? res.statusText; throw new Error(`HTTP ${res.status}: ${msg}`); } if ...[truncated 4336 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (88)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: If the implementation has no image compression, no conversion, and no file-size optimization, but instead validates prompts and image URLs, then the skill is fundamentally misrepresented. A mislabeled skill is dangerous because it can hide unrelated networked behavior and defeat user intent, review trust, and least-privilege assumptions.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
- `scripts/main.ts`

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This compression skill includes instructions to configure an image-generation API key and initialize a generation workspace, which is outside the declared scope of image compression/conversion. That scope mismatch can cause unnecessary secret handling and unauthorized setup actions, increasing the chance an agent will collect credentials or modify the project for capabilities the user did not request.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file does not implement image compression or conversion behavior; instead, it builds image-generation visual briefs, interactive questions, and prompt directives, and can write them to disk. In a skill advertised as 'compress-image', this is a capability mismatch that can enable unauthorized prompt construction or hidden image-generation workflow support, violating least privilege and user/operator expectations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The hardcoded WeryAI documentation endpoints and subsequent fetch logic give this file a network-based scraping/discovery capability. For a skill whose stated purpose is local image compression, optimization, or WebP conversion, remote provider documentation access is not directly justified.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest describes a skill for compressing or converting generated images for delivery and upload. This file instead fetches WeryAI documentation from external URLs, parses model tables, and builds a model registry for image-generation capabilities, which is a substantively different behavior than image compression or format conversion.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The script directly opens and reads a .env file to detect whether a gateway API key is present. Reading secret-bearing files is sensitive behavior, and in the context of a compression skill it is especially unjustified, making the access surface broader than necessary and raising the chance of accidental credential disclosure in future changes or integrated tooling.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/doctor.mjs (reported line 90)May include surrounding context.
js
const projectSkillDir = path.join(projectRoot, ".image-skills", skillNamespace); const homeSkillDir = homeRoot ? path.join(homeRoot, ".image-skills", skillNamespace) : null; const projectEnvPath = path.join(projectRoot, ".image-skills", skillNamespace, ".env"); const projectEnvFile = pathExists(projectEnvPath); let apiKeyInProjectEnv = false; if (projectEnvFile) {

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/doctor.mjs (reported line 284)May include surrounding context.
js
const hasApiKey = hasDetectedApiKey(config); if (!hasApiKey) { warnings.push(`IMAGE_GEN_API_KEY was not detected in the environment or project .image-skills/${skillNamespace}/.env`); suggestions.push(`Provide IMAGE_GEN_API_KEY, then rerun \`npm run setup -- --project . --persist-api-key\` or write .image-skills/${skillNamespace}/.env before using gateway generation`); } const hasDefaultModel = hasDetectedDefaultModel(config);

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/main.ts (reported line 577)May include surrounding context.
ts
const hasApiKey = hasDetectedApiKey(config); if (!hasApiKey) { warnings.push(`IMAGE_GEN_API_KEY was not detected in the environment or project .image-skills/${skillNamespace}/.env`); suggestions.push(`Provide IMAGE_GEN_API_KEY, then rerun \`npm run setup -- --project . --persist-api-key\` or write .image-skills/${skillNamespace}/.env before using gateway generation`); } const hasDefaultModel = hasDetectedDefaultModel(config);

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata says this skill compresses or converts images, but this file is actually a remote image-generation client that sends prompts and optional reference images to an external service and downloads generated outputs. That is a material capability mismatch that can cause users or downstream agents to disclose sensitive images/prompts or trigger networked generation when they expected only local post-processing.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/vendor/shared-image-generation/scripts/main.ts (reported line 403)May include surrounding context.
ts
function hasProjectScopedConfig(projectRoot: string): boolean { const baseDir = path.join(projectRoot, ".image-skills", SKILL_NAMESPACE); return existsSync(path.join(baseDir, ".env")) || existsSync(path.join(baseDir, "EXTEND.md")); } function resolveProjectRoot(argv: string[] = process.argv.slice(2)): string {