Security audit

ChatMask

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent screenshot-redaction purpose, but it installs and runs code fetched from outside the reviewed package and can attempt a host package-manager install.

Review before installing. The image-redaction workflow itself is understandable, but installation depends on code and dependencies fetched outside the submitted skill package, and the setup may attempt a system package install. Prefer running it in a restricted environment, verify the pinned upstream source yourself, and avoid running setup with root or package-manager privileges.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:33
Finding: Externally Retrieved Runtime and Dependencies Are Executed Without Artifact Integrity Verification
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:43
Finding: Automatic Host Package Installation Exceeds the Skill's Required Privileges
Content: View full analysis
Remediation: View remediation
/dev/null 2>&1; then echo "The Python venv module is required. Ask an administrator to install it." >&2 exit 1 fi ``` 5. Report filesystem, disk-space, and permission failures separately rather than attempting package installation. 6. Run the Skill as a non-root account and prevent access to `sudo`, package managers, and other host-administration capabilities. 7. Prefer a prebuilt, reviewed execution environment containing the required Python runtime and dependencies. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
PYTHON="$CHAT_PIXELATE_PATH/.venv/bin/python3"

text
> **What this installs:** Pillow (image processing) and python-dotenv (.env loader > for standalone use only). The `requests` package is **not** installed by the > skill — it is only needed for standalone/non-skill mode and lives in > `requirements-standalone.txt`. No network calls are made by the script at runtime.

Static analysis

No suspicious patterns detected.