Security audit

Imgur CLI

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Imgur command-line skill that uploads user-specified images to Imgur and manages them, with the main risk being that uploads leave the local machine and may be publicly reachable.

Install only if you want agents to send selected images or image URLs to Imgur. Treat uploaded images as external and potentially public, avoid sensitive screenshots or private files, keep OAuth tokens scoped to the account you intend to use, and preserve anonymous delete hashes if you may need cleanup later.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 3)May include surrounding context.
md
# imgur-cli Imgur API CLI for AI agents. Upload/get/delete images, manage albums. Works with anonymous uploads (Client-ID) or authenticated uploads (OAuth access token). Zero extra deps beyond `requests`. - Official API: https://apidocs.imgur.com/ - Auth: `IMGUR_CLIENT_ID` (anonymous) **or** `IMGUR_ACCESS_TOKEN` (user-owned)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · src/imgur_cli/cli.py (reported line 17)May include surrounding context.
python
# imgur-cli Imgur API CLI for AI agents. Upload/get/delete images, manage albums. Works with anonymous uploads (Client-ID) or authenticated uploads (OAuth access token). Zero extra deps beyond `requests`. - Official API: https://apidocs.imgur.com/ - Auth: `IMGUR_CLIENT_ID` (anonymous) **or** `IMGUR_ACCESS_TOKEN` (user-owned)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises upload and delete capabilities but does not clearly warn that uploads transmit images and metadata to a third-party public hosting service, or that delete operations can irreversibly remove hosted content. In an agent context, this omission can cause unintended disclosure of local files or accidental destructive actions because operators may treat the tool as a neutral local utility rather than an external publishing/deletion primitive.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 79% confidence
Finding: This skill is explicitly designed to send data to Imgur, so the external transmission is intentional rather than hidden. However, in an agent environment this is still security-relevant because the tool enables exfiltration of local images or remote content to a third-party service, and the README does not prominently frame this as a data-boundary crossing with privacy implications.
Content: Scanner excerpt · README.md (reported line 33)May include surrounding context.
md
AI agents that post to Instagram, Discord, Reddit, etc. frequently need a zero-friction image host. Imgur has a simple Client-ID upload flow and generous anonymous quotas — perfect as a hosting primitive for agent pipelines. No other ClawHub skill wraps Imgur directly. ## Environment variables - `IMGUR_CLIENT_ID` — required for anonymous uploads (get one at https://api.imgur.com/oauth2/addclient) - `IMGUR_ACCESS_TOKEN` — optional OAuth2 bearer token for uploads to a specific user account If both are set, `IMGUR_ACCESS_TOKEN` takes precedence.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill performs network access, reads local files, and consumes environment secrets, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, this can cause the skill to be invoked with broader capabilities than users expect, increasing the risk of unintended file exfiltration or secret-assisted uploads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description encourages turning local files into public URLs but does not warn that uploads are publicly hosted and may expose sensitive images, screenshots, metadata, or other local content. In an autonomous agent workflow, this omission makes accidental disclosure materially more likely because users may not realize the publication is external and potentially irreversible.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
import requests BASE = "https://api.imgur.com/3" def _auth_headers(access_token: Optional[str] = None, client_id: Optional[str] = None) -> Dict[str, str]:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · src/imgur_cli/core.py (reported line 8)May include surrounding context.
python
import requests BASE = "https://api.imgur.com/3" def _auth_headers(access_token: Optional[str] = None, client_id: Optional[str] = None) -> Dict[str, str]:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The function accepts an arbitrary local file path, reads the file, base64-encodes its contents, and transmits them to Imgur. In an agent setting, this can cause unintended exfiltration of local sensitive files if the path is influenced by a user, prompt, or upstream tool and there is no explicit consent or allowlist around what may be uploaded.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The delete_image function issues a remote DELETE request that can remove an image, which is an irreversible/destructive action. The code contains no confirmation step, warning, log message, or explanatory docstring/comment indicating that deletion will occur.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: setuptools has 10 known advisory(ies) (CVE-2013-1633 (Setuptools vulnerable to Man-in-the-middle attacks); CVE-2025-47273 (setuptools has a path traversal vulnerability in PackageIndex.download that lead); CVE-2024-6345 (setuptools vulnerable to Command Injection via package URL) +7 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: wheel has 4 known advisory(ies) (CVE-2026-24049 (Wheel Affected by Arbitrary File Permission Modification via Path Traversal in w); CVE-2022-40898 (pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)); CVE-2022-40898 (An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlie) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 40% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The authentication helper accesses IMGUR_ACCESS_TOKEN and IMGUR_CLIENT_ID from the environment, which are credential-related values. There is no docstring, comment, or user-facing note explaining that the skill consumes credentials from environment variables.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.