Sprite Tools

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:53 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed sprite image-processing toolkit with some install and privacy cautions, but no hidden or destructive behavior was found.

Install dependencies in a virtual environment instead of using --break-system-packages, avoid the optional sudo command unless you understand why it is needed, and use only the local scripts for private or proprietary images. If using remove.bg, assume the image is uploaded to a third-party service and protect the API key.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Packages Installed into the System-Managed Python Environment## Vulnerability Details **File Location**: `SKILL.md`, lines 23–25 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium **Vulnerable code:** ```bash pip install --break-system-packages Pillow numpy # Optional, for more precise background removal: pip install --break-system-packages rembg ``` The `rembg` installation command is repeated at line 184: ```bash pip install --break-system-packages rembg ``` ### Technical Analysis The installation instructions do not pin package versions, constrain transitive dependencies, or verify package hashes. Consequently, the installed code can change between installations even though the reviewed Skill package remains unchanged. The `--break-system-packages` option disables the protection for externally managed Python environments. This can modify or conflict with operating-system-managed packages and exceeds the minimum privileges needed by a local image-processing toolkit. The dependencies can instead be installed in a dedicated virtual environment without altering the host Python installation. The documented optional `rembg` workflow also downloads a model on first use. Although this behavior is disclosed, the downloaded artifact is mutable external content and is not covered by the static review of this repository. ### Attack Path 1. A user follows the installation commands in `SKILL.md`. 2. `pip` resolves the latest available versions of the named packages and their transitive dependencies. 3. A compromised package release, dependency, package-index response, or dependency-resolution event supplies attacker-controlled installation or runtime code. 4. The malicious dependency executes with the privileges of the user running `pip` or invoking the image-processing workflow. 5. Because installation uses `--break-system-packages`, the package may alter or conflict with the host's system-managed Python environment rather than remaining ...[truncated 866 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--break-system-packages` and install dependencies in a dedicated virtual environment: ```bash python3 -m venv .venv . .venv/bin/activate python -m pip install --upgrade pip python -m pip install --require-hashes -r requirements.txt ``` 2. Pin exact versions of direct and transitive dependencies in a reviewed lock file. 3. Record and enforce cryptographic hashes with `--require-hashes`. 4. Use a trusted, explicitly configured package index and disable unintended extra indexes. 5. Pin the optional background-removal model to an expected version and verify its checksum before loading it. 6. Document that cloud API use sends images to a third party and recommend the local-only scripts for confidential assets. 7. Run image processing as an unprivileged user in a constrained environment when handling untrusted image files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code substantially overlaps with the declared image-processing purpose: it performs batch grid splitting, background removal, alpha-based trimming, and writes outputs to a specified directory or /tmp/sprite_out/. However, the description claims a broader toolkit with multiple methods and a no-external-dependency PIL fallback, while this specific code chunk implements only one pipeline and requires NumPy. It also removes a hard-coded dark background color rather than using an existing alpha channel as the primary background-removal mechanism. Therefore the description does not accurately represent this supplied code chunk in full, even though the general domain and primary use case are aligned.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: SQP-3 applies to all file types and covers language or locale policy violations. This skill's natural-language documentation and usage guidance are exclusively in Chinese, and the file does not provide an English alternative, user opt-in, or justification that the skill is intended only for a Chinese-speaking or region-specific context.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 可选（更精准的抠图）：
pip install --break-system-packages rembg
# 可选（ImageMagick，备选）：
sudo apt install imagemagick
```

## 快速参考

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill documentation expands from local image processing into a third-party web API workflow that uploads local image content to remove.bg. That creates an unexpected data-transmission path for user files, which is security-relevant because users may assume all processing is local based on the skill's stated purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The markdown includes a ready-to-use example that sends local image files to remove.bg without a conspicuous warning that user data leaves the machine and is transmitted to a third party. In the context of a skill marketed primarily as a local sprite-processing toolkit, that omission increases the risk of accidental privacy or IP leakage.

External Transmission

Medium

• Category: Data Exfiltration

Content

def removebg_api(input_path, output_path, api_key):
    with open(input_path, 'rb') as f:
        r = requests.post(
            'https://api.remove.bg/v1.0/removebg',
            files={'image_file': f},
            data={'size': 'auto'},

• Confidence: 97% confidence
• Finding: This code example performs an HTTP POST to a third-party endpoint and includes the local image file in the request body. That is a real external transmission path, and if users run it with private, licensed, or unreleased assets, the skill can facilitate unintended disclosure outside the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

def removebg_api(input_path, output_path, api_key):
    with open(input_path, 'rb') as f:
        r = requests.post(
            'https://api.remove.bg/v1.0/removebg',
            files={'image_file': f},
            data={'size': 'auto'},
            headers={'X-Api-Key': api_key}

• Confidence: 96% confidence
• Finding: The explicit reference to the remove.bg endpoint confirms the documentation is directing users toward third-party transmission of local image content. In this skill's context, that broadens the trust boundary beyond local processing and can expose sensitive assets or API credentials if used incautiously.

Intent-Code Divergence

Low

• Confidence: 63% confidence
• Finding: The inline explanation says the lightweight remover is based on superpixel SLIC/SLICO segmentation, which implies a more advanced algorithm and likely extra dependencies, while the skill's stated documentation elsewhere frames it as a simple PIL/numpy fallback. This is an intent/documentation inconsistency about what the tool actually is.

Description-Behavior Mismatch

Low

• Confidence: 85% confidence
• Finding: The manifest scope is limited to sprite grid splitting and background removal for images, but the dependency table states ffmpeg is used for video frame extraction. Video processing is a distinct capability that is not justified by the described image-only toolset.

Intent-Code Divergence

Low

• Confidence: 89% confidence
• Finding: The module docstring documents a different filename and invocation target than the actual file being analyzed. This is an active documentation contradiction that can mislead operators about what artifact they are executing, even though the implemented behavior is still a local image-processing pipeline.

Static analysis

No suspicious patterns detected.