Chen Image

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:37 PM UTC
• Version: 1.0.0

Overview

This image-processing skill is coherent and transparent, but users should be careful with its unpinned npx command examples because they can execute code from npm.

Install is reasonable if you want image-processing guidance. Before running command examples, especially npx svgo or npx sharp, prefer pinned versions, project-local locked dependencies, or --no-install, and run them only on files and in directories you are comfortable letting image tools access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: commands.md:33

Finding

Unpinned npx Package Execution Exposes the Host to Supply-Chain Compromise

Content

View full analysis

Vulnerability Details

File Location: commands.md, lines 33 and 110-111; related warning at line 144
Vulnerability Type: Execution of unpinned third-party packages through npx
Risk Level: Medium

Vulnerable Code

bash

npx svgo input.svg -o output.svg

bash

npx sharp input.jpg --resize 1600 --webp quality=80 -o output.webp
npx sharp input.png --flatten background=white --jpeg quality=85 -o output.jpg

The document itself acknowledges the execution risk at line 144:

markdown

- Treat `npx` examples as remote-code execution from the package registry and use them only in trusted environments.

Technical Analysis

The documented commands invoke svgo and sharp through npx without pinning package versions or verifying package integrity. If an appropriate package is not already installed locally, npx may retrieve executable package content from the configured npm registry.

This makes the effective code dependent on mutable external registry state rather than solely on the reviewed Skill package. Package lifecycle scripts, transitive dependencies, or the requested package executable can run with the privileges of the user invoking npx. Potential compromise scenarios include a malicious package release, maintainer account takeover, registry or network configuration compromise, dependency confusion, and unexpected package-name resolution.

The warning at line 144 accurately identifies this concern, but it does not technically prevent an agent or user from running the examples. The affected commands therefore remain unsafe defaults for automated execution.

Attack Path

1. A user asks the agent to optimize an SVG or process an image.
2. The agent loads commands.md and selects one of the documented npx examples.
3. The requested package is unavailable in the trusted local dependency set.
4. npx resolves and downloads package content from the configured registry without a version pin or project lockfile.

...[truncated 941 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace on-demand registry execution with dependencies installed from a reviewed project manifest and lockfile.
2. Pin exact package versions rather than resolving mutable latest releases.
3. Run locally installed binaries, such as ./node_modules/.bin/svgo and ./node_modules/.bin/sharp, after verifying the lockfile and package integrity.
4. If npx must be retained, use npx --no-install so execution fails instead of downloading an absent package.
5. Require explicit user confirmation before any package retrieval or installation.
6. Verify package identity, publisher, provenance, integrity hashes, and transitive dependencies before use.
7. Execute image-processing tools in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and constrained network access.
8. Convert the existing advisory warning into an enforceable instruction that prohibits automated retrieval and execution of unreviewed packages.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The npx svgo input.svg -o output.svg example executes a package resolved from the npm registry without pinning a version, which can cause users to run unexpected or newly compromised code. Because npx may fetch and execute code on demand, a malicious package update, dependency compromise, or typo/confusion in package resolution could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The npx sharp input.jpg --resize 1600 --webp quality=80 -o output.webp example invokes an unpinned npm package directly from the registry, creating a remote code execution path if the package or one of its fetched dependencies is compromised. In a command reference skill, users may copy-paste this directly, which increases practical exposure even though the author's likely goal is convenience rather than harm.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This second npx sharp example has the same underlying issue: it may cause on-demand download and execution of unpinned code from npm. If an attacker compromises the package supply chain or tricks users into relying on mutable latest versions, the command could execute arbitrary code under the user's privileges.

Content

No source excerpt is available for this finding.