T08 · Insecure Dependencies
Note
- Location
SKILL.md:11- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
ImageCompress
Security checks for vulnerabilities and agentic risk
Overview
This image-compression skill mostly does what it claims, but it uses an unofficial TinyPNG/Tinify web endpoint with spoofed headers and can overwrite user files with unvalidated downloaded content.
Install only if you are comfortable sending selected images to TinyPNG/Tinify through an unofficial web endpoint. Do not use it for sensitive, personal, confidential, or proprietary images, avoid --overwrite, and prefer the official TinyPNG API or a local compressor for controlled environments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tiny_compress.py:160- Finding
Unvalidated Server-Controlled Download URL and Response Body
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The skill supports an overwrite mode that replaces the original file in place, which is a destructive file-modification capability. Even though the documentation says to use it only when the user explicitly wants replacement and warns that it is irreversible, a mistaken invocation or ambiguous consent could permanently destroy the original image and any metadata it contained.
- Content
4. Overwrite Mode
When user explicitly wants to replace original files:
bash python "{SKILL_DIR}/scripts/tiny_compress.py" compress "<file>" --overwrite
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
Documenting --overwrite as a standard parameter advertises a destructive file-write option without any technical safeguard beyond prose warnings. In the context of an agent skill, this increases the risk that an autonomous workflow may choose in-place replacement and irreversibly alter user files.
- Content
md |-----------|-------------|---------| | `--output-dir <dir>` | Output directory | Same dir with `_compressed` suffix | | `--server cn\|global` | Server selection | `global` | | `--overwrite` | Overwrite original files | `false` | | `--recursive` | Recurse into subdirectories (compress-dir only) | `false` | **How it works:**
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
python if output_dir: print(f"[OUTPUT] {output_dir}") elif overwrite: print("[MODE] Overwrite original files") else: print("[MODE] Generate _compressed suffix files") print("=" * 60)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill clearly instructs the agent to use a script that makes outbound network requests to TinyPNG/Tinify, but the manifest does not declare any tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: an agent or reviewer may not realize the skill exfiltrates user-provided images to third-party servers, increasing privacy and governance risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The activation text includes generic phrases such as "compressing images," "reducing image size," and "compress image," which are broad natural-language requests rather than narrowly scoped invocation cues. The description does include a NOT-for list, but it does not provide clear trigger boundaries or explicit invocation phrases to prevent unintended matching in everyday conversation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool uploads user-supplied image contents to external TinyPNG/Tinify servers, but the description and CLI flow do not prominently warn users that local files leave the machine and are processed by a third party. This creates privacy and data-handling risk, especially if users compress sensitive or proprietary images assuming processing is local.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The --overwrite option can irreversibly replace the original file with downloaded remote output and does so without confirmation, backup, or atomic safety measures. If used on the wrong files or if a bad/partial response is saved, the original data may be lost immediately.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The surrounding comments explicitly describe avoiding restrictions and rate limits, indicating the tool is designed to minimize detection rather than just perform compression. In context, this increases concern that the script is intentionally built to evade service protections on an unofficial web endpoint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code deliberately randomizes User-Agent values and forges X-Forwarded-For and Postman-Token headers to make requests look like different clients and reduce blocking. That behavior is not necessary for legitimate image compression and crosses into anti-detection/rate-limit evasion, which can facilitate abuse of a third-party service and bypass provider controls.
- Content