Dpi Upscaler Checker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:37 AM UTC
• Version: 0.1.0

Overview

The skill's own script is a coherent local image DPI/upscaling tool, but its installation manifest uses ambiguous and unpinned Python packages that need review before installation.

Review and replace the dependency manifest before installing: remove cv2 and pil, keep canonical packages, pin reviewed versions or use a lockfile, and install in an isolated nonprivileged environment. Run the tool only on intended image folders and choose an output directory where creating many new files is acceptable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Ambiguous and Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6
Vulnerability Type: Dependency confusion, ambiguous package naming, and non-reproducible dependency resolution
Risk Level: Medium

Vulnerable Code

text

cv2
numpy
opencv-python
pil
pillow
realesrgan

The installation command documented in SKILL.md:145-148 activates the vulnerable dependency resolution:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The requirements file specifies every dependency without a fixed version or integrity hash. Consequently, package versions and artifacts are selected dynamically from the configured Python package index at installation time rather than from a reviewed, reproducible dependency set.

The entries cv2 and pil are particularly concerning because they are ambiguous or noncanonical names for the libraries used by the implementation. The canonical distributions, opencv-python and pillow, are already listed separately. Installing both names unnecessarily expands the supply-chain attack surface and may expose users to dependency confusion, typosquatting, or unrelated packages published under familiar import names.

Python packages may execute attacker-controlled code during source builds or through malicious installation mechanisms. Therefore, an unsafe dependency can compromise the environment before the Skill itself is run. The realesrgan package is also installed unconditionally even though the documentation describes it as optional and the audited implementation only attempts to import RealESRGANer; it does not instantiate or use that component for upscaling.

No evidence was found that the Skill's own Python code intentionally downloads a payload or performs malicious activity. The risk arises from the documented installation process and dependency manifest.

Attack Path

1. A user or automated Agent follows the prerequisite in SKILL.md and runs `pip install -r requirements ...[truncated 1436 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the ambiguous duplicate dependencies:
   • Remove cv2; retain the reviewed canonical opencv-python distribution.
   • Remove pil; retain the reviewed canonical pillow distribution.
2. Pin every direct and transitive dependency to a reviewed version using a lock file generated by a dependency-management tool.
3. Add cryptographic hashes and install with hash verification, such as:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Move realesrgan into an explicit optional dependency group, or remove it until the implementation actually supports that engine.
5. Review package provenance, maintainer history, release signatures where available, and known vulnerability advisories before selecting versions.
6. Install dependencies in an isolated virtual environment or container under a nonprivileged account.
7. Configure pip to use an approved package index and prohibit unexpected fallback indexes.
8. Add automated dependency scanning and lock-file integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Possible Typosquatting: 'pil' resembles popular package 'pip'

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency name 'pil' is highly suspicious in a modern Python requirements file and may reflect package confusion, legacy confusion, or typosquatting risk. If an unintended package is installed, the attacker-controlled code could execute during installation or import, making this substantially more dangerous than ordinary version drift.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documentation describes file-writing behavior and batch processing, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between documented capabilities and declared constraints, increasing the chance that an agent or reviewer cannot accurately enforce least-privilege execution or anticipate write operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file includes its primary descriptive text and operational messages in Chinese, with no indication that the user can choose another language or locale. The policy explicitly flags language or locale constraints when they are imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The usage section shows upscale commands that can write new files and recursively process folders, but it does not give a clear warning about overwrite risk, storage growth, or broad batch effects. In a skill that manipulates user-supplied paths, missing warnings make accidental misuse more likely and can lead to unintended modification of many files.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency list is unpinned, which makes builds non-reproducible and can silently pull in newer or compromised releases over time. In a security-sensitive image-processing skill, this increases supply-chain risk because installation behavior may change without review.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

cv2
numpy
opencv-python
pil

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Leaving numpy unpinned allows whatever version is current at install time, making it impossible to verify whether known-vulnerable releases are avoided. This creates avoidable supply-chain uncertainty and undermines reproducibility.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

cv2
numpy
opencv-python
pil
pillow

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Because numpy is not pinned, there is no assurance that the installed version avoids known advisories. This is not proof that a vulnerable version will always be installed, but it is a real security weakness because the manifest cannot be audited to a safe state.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

An unpinned opencv-python dependency can resolve to different versions across environments, including versions with known security defects. For an image-processing skill that will parse untrusted image data, dependency drift is especially undesirable.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

cv2
numpy
opencv-python
pil
pillow
realesrgan

Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

opencv-python has known historical advisories, and the manifest does not constrain the version, so an unsafe build could be installed without visibility. This matters more here because the skill is designed to decode and manipulate externally supplied image files, which increases exposure to parser bugs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The 'pil' entry is unpinned and also suspicious because it is not the normal modern package name for Pillow-based imaging. If this resolves to an unintended or malicious package, it could introduce arbitrary code during installation or runtime.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

cv2
numpy
opencv-python
pil
pillow
realesrgan

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pillow is unpinned, so installs may pull different versions with varying security posture and parser behavior. Because this skill processes images, uncontrolled library changes can expose the system to image-parsing vulnerabilities or denial of service.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

numpy
opencv-python
pil
pillow
realesrgan

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pillow has a history of image-parsing vulnerabilities, and an unpinned dependency prevents verification that deployed versions are safe. Since this skill directly opens and transforms images, any vulnerable Pillow release would be in a reachable attack path.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

An unpinned realesrgan dependency creates supply-chain and reproducibility risk, especially for an ML-oriented package that may pull in a larger transitive dependency graph. Unreviewed updates can change behavior or introduce vulnerable components.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

opencv-python
pil
pillow
realesrgan

Static analysis

No suspicious patterns detected.