实用工具匣

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:35 AM UTC
• Version: 1.0.0

Overview

This image-processing skill mostly does what it says, but it tells the agent to automatically install unpinned third-party packages and download model files, which can change the user's environment without a clear approval step.

Install only if you are comfortable with the agent modifying its Python environment and downloading OCR/background-removal models. Prefer reviewing or pinning dependencies first, using a virtual environment or container, and approving any package installation explicitly. Use the watermark-removal feature only on images you have the right to edit.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:64

Finding

Automatic Installation of Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64,72
Vulnerability Type: Unpinned and automatically installed dependencies
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools:
  - Bash(python3*)
  - Bash(pip*)

bash

python3 -m pip install easyocr opencv-python-headless Pillow rembg numpy onnxruntime

text

3. Check dependencies: On first use or when a script reports ModuleNotFoundError, automatically install dependencies.

Technical Analysis

The Skill permits pip execution and instructs the Agent to install six third-party packages automatically. No versions, hashes, lockfile, or explicit trusted package index are specified. Consequently, package resolution depends on mutable package-index state at installation time, including the latest compatible direct and transitive dependencies.

Python package installation and subsequent imports can execute package-controlled code with the privileges of the Agent process. The reviewed dependencies are consistent with the declared image-processing functionality, and the audit found no evidence that the repository intentionally names a known malicious or typosquatted package. Nevertheless, the installation process lacks supply-chain integrity controls.

The same unpinned command is also documented at README.md:16:

bash

pip install opencv-python-headless Pillow numpy rembg onnxruntime easyocr

Attack Path

1. A user invokes OCR, background removal, or another feature whose dependency is absent.
2. Following SKILL.md:72, the Agent automatically invokes the unpinned pip installation command.
3. pip resolves direct and transitive packages from the configured package index at that moment.
4. If a dependency, transitive dependency, package-index account, or configured index has been compromised, attacker-controlled package code is installed.
5. Installation hooks or imported module code executes under the Agent user's account when the package is installed or t ...[truncated 719 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed lockfile that pins every direct and transitive dependency to an exact version.

2. Record cryptographic hashes and install with hash verification, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Configure an explicit trusted package index or an internally controlled package mirror rather than relying on ambient pip configuration.

4. Remove the instruction to install packages automatically after ModuleNotFoundError. Ask for explicit user approval and display the exact packages, versions, index, and hashes before installation.

5. Install dependencies in a dedicated virtual environment or restricted container with minimal filesystem and network permissions.

6. Scan and periodically review both direct and transitive dependencies for known vulnerabilities and unexpected ownership or release changes.

7. Update README.md:16 to use the same pinned, hash-verified installation process.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码仅实现了“图片压缩”这一项功能，具体包括质量调节、尺寸缩放、格式转换、按目标大小二分搜索压缩质量，以及输出压缩率报告。没有任何去水印、OCR识别、证件照裁切/换底/尺寸规范生成相关逻辑。因此，声明将其描述为集合四大高频图像工具，与实际代码能力明显不符，属于能力范围被显著夸大。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码块仅实现了“标准证件照生成”相关功能，没有看到去水印、OCR 文字识别或通用图片压缩功能。虽然保存 JPEG 时可设置 quality，输出文件大小也会变化，但这属于证件照导出参数，不足以构成所宣称的独立‘图片压缩’工具能力。代码的主要用途与声明中的四合一工具包不一致，实际只是其中一个子功能，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

代码行为与声明存在明显范围不一致。声明将该技能描述为集合四项图片处理能力的一站式工具，但当前提供的代码块只对应“去水印”子功能，没有任何文字识别、压缩或证件照生成逻辑。因此，如果将这段代码视为该技能的实际实现，则描述夸大了已实现能力。未发现额外的未声明高风险行为；问题主要是声明的功能范围大于代码实际能力。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest and operating instructions are entirely in Chinese, and L59 explicitly states OCR defaults to recognizing Chinese and English. There is no visible user opt-in or documented locale constraint, so the skill may impose a language/locale assumption without choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to automatically run pip installation commands, including large third-party packages and ML runtimes, based on operational need rather than explicit user approval. This is dangerous because package installation executes code and changes the environment, expanding supply-chain risk and enabling unintended system modification in contexts where the user only requested image processing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Automatically executing package-install commands without a clear warning or consent boundary is a real security issue. Even if the packages are legitimate, pip installs can run untrusted setup/build logic, pull transitive dependencies, and alter the host environment in ways the user did not authorize.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code explicitly notes that EasyOCR may download models on first use when constructing the reader, which introduces network access during execution of a tool whose advertised purpose is local OCR on user images. This creates an unexpected outbound dependency and data-flow risk in restricted or privacy-sensitive environments, and can also undermine reproducibility or supply-chain controls if runtime downloads are not pinned and preapproved.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

Natural-language policy violations include forcing a specific language or locale without user opt-in. The README states 'EasyOCR 中英文混合', which constrains OCR language behavior to Chinese and English, but does not indicate this is optional, configurable, or intentionally region-scoped.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

For markdown files, missing-warning findings apply when the description omits warnings about behaviors affecting privacy or system integrity. This README notes automatic network downloads for OCR and ID-photo features, and OCR/ID-photo workflows commonly involve sensitive screenshots or personal photos, but it provides no user-facing privacy caution beyond connectivity.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and CLI help text are written in Chinese, which imposes a specific language/locale on users without offering a choice. The policy for this audit flags language-forcing behavior unless the skill explicitly provides language selection or a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring presents the tool exclusively in Chinese, and the command-line help text and user-facing messages throughout the file follow the same pattern. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.