Image Metadata Cleaner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:36 AM UTC
• Version: 1.0.2

Overview

This image metadata cleaner is mostly coherent, but its optional report file can overwrite other writable files without the same confirmation protections promised for image outputs.

Install only if you are comfortable with a local image-processing script that writes files. Use dry-run first, avoid custom --manifest paths unless you trust the destination, do not run it on untrusted images in a privileged environment, and prefer a pinned/locked Pillow install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/strip.py:226

Finding

Manifest Output Can Silently Overwrite Arbitrary Writable Files

Content

View full analysis

None: path.parent.mkdir(parents=True, exist_ok=True) path.write_text( json.dumps([asdict(report) for report in reports], indent=2), encoding="utf-8", ) ``` ```python manifest_path = None if args.manifest: manifest_path = Path(args.manifest) if not manifest_path.is_absolute(): if batch: manifest_path = output_root / manifest_path else: first_output = reports[0].output manifest_path = (Path(first_output).parent if first_output else src.parent) / manifest_path if not args.dry_run: write_manifest(manifest_path, reports) ``` ### Technical Analysis The value accepted by `--manifest` directly controls the destination passed to `Path.write_text()`. This method opens the destination for writing and truncates an existing file. The manifest-writing code does not perform any of the protections applied to image outputs: - It does not reject an existing destination unless overwrite permission was explicitly provided. - It does not prevent the manifest from targeting the input image or another user file. - It does not reject symbolic links. - It does not use exclusive file creation. - It accepts absolute paths and resolves relative paths into writable output locations. Consequently, any existing file writable by the process can be replaced with the generated JSON report. If the destination is a symbolic link, the write can follow that link and overwrite its target. This issue does not independently elevate privileges: the process must already have permission to write the selected target. However, it violates the documented expectation that destructive overwr ...[truncated 1323 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:40

Finding

Unpinned Pillow Dependency Is Dynamically Resolved at Runtime

Content

View full analysis

=10.0" scripts/strip.py "" --dry-run ``` ```bash uv run --with "pillow>=10.0" scripts/strip.py "" --manifest ``` ```bash pip install "pillow>=10.0" && python scripts/strip.py "" --manifest ``` ```toml dependencies = [ "pillow>=10.0.0", ] ``` ### Technical Analysis The documented execution flow dynamically resolves any Pillow release satisfying the lower-bound constraint. The project does not provide a lockfile, an upper version boundary, package hashes, or an explicit trusted package index. As a result, the dependency installed and executed can change without any modification to the audited project. A future compromised, malicious, or behaviorally incompatible package artifact could therefore become part of the effective execution path after this version of the skill has already been reviewed. The package name itself is legitimate and no malicious dependency was observed in the supplied project. The risk arises from mutable, unverified dependency resolution rather than a confirmed malicious Pillow release. ### Attack Path 1. A user follows the documented `uv run --with` or `pip install` command. 2. The package resolver contacts its configured package index and selects a current release satisfying `pillow>=10.0`. 3. The selected artifact is installed without verification against a project-controlled lockfile or cryptographic hash. 4. `scripts/strip.py` imports Pillow: ```python from PIL import Image, ImageOps, UnidentifiedImageError ``` 5. Code from the resolved dependency executes in the Python process. 6. If the selected artifact or package source has been compromised, its code receives the same operating-system privileges and environment a ...[truncated 730 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs the agent to write sanitized image copies and manifests, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch means an agent may infer broader file-write capability than is necessary, increasing the risk of unintended writes, overwrites, or use of file operations outside the intended directory structure. The privacy-focused context lowers suspicion of malicious intent, but the missing scope still weakens containment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest trigger list includes generic phrases such as "clean metadata", "image privacy", "metadata cleanup", and especially "clean image", which do not clearly constrain invocation to metadata stripping. Without narrower scope or exclusion examples, these phrases could match unrelated everyday requests about editing or improving images.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency is only lower-bounded as "pillow>=10.0.0", so installs may resolve to any future or repository-available version without demonstrating that a patched, vetted release is consistently used. Because this skill processes untrusted image files, a vulnerable Pillow build could expose the host to parser bugs such as denial of service or, in some versions, potentially code execution when crafted images are opened.

Content

No source excerpt is available for this finding.