Base64 Toolkit

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:39 AM UTC
• Version: 1.0.0

Overview

This Base64 utility is mostly coherent, but its image conversion command can expose any readable local file because it does not verify that the input is an image.

Install only if you are comfortable with the skill reading local files that the agent points it at. Use image-encode only on files you have verified are intended images, and avoid invoking --file or image-encode on sensitive paths such as keys, tokens, configuration files, or private documents.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/base64_toolkit.py:63

Finding

Arbitrary Local File Disclosure Through Insufficient Image Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/base64_toolkit.py, lines 63-77
Vulnerability Type: Arbitrary local file read and disclosure
Risk Level: Medium

Vulnerable Code

python

def encode_image(file_path: str) -> dict:
    """Convert image to Base64 data URI."""
    try:
        if not os.path.exists(file_path):
            return {"success": False, "error": f"File not found: {file_path}"}
        
        # Detect MIME type
        mime_type, _ = mimetypes.guess_type(file_path)
        if not mime_type or not mime_type.startswith('image/'):
            mime_type = 'image/png'  # Default fallback
        
        # Read and encode
        with open(file_path, 'rb') as f:
            image_data = f.read()

Technical Analysis

The image-encode action is presented as an image conversion operation, but the implementation accepts any readable local path. mimetypes.guess_type() only infers a media type from the file name or extension and does not inspect or validate the file contents.

When the inferred type is absent or is not an image type, the code does not reject the file. Instead, it assigns the false fallback type image/png, reads the complete file, Base64-encodes its contents, and returns those contents in the JSON output as both a data URI and raw Base64.

Consequently, a non-image file such as a configuration file, private key, token file, or operating-system file can be processed and disclosed as though it were an image. Exploitation requires control over the input path or the ability to induce an agent or user to invoke the action with an attacker-selected path.

Attack Path

1. An attacker supplies or influences the --input argument used with the image-encode action.
2. The attacker selects a sensitive file readable by the Python process, for example:

   bash

   python3 scripts/base64_toolkit.py image-encode --input /path/to/sensitive-file
   ``
   

...[truncated 1091 chars]

Remediation

View remediation

Remediation Suggestions

1. Reject inputs whose detected type is absent or does not begin with image/; do not relabel arbitrary files as image/png.
2. Validate file contents using a trusted image parser or signature-based detection rather than relying solely on the extension.
3. Restrict file access to an explicitly approved workspace or upload directory by resolving the canonical path and confirming it remains beneath the allowed root.
4. Reject symbolic links where they could bypass path restrictions, or resolve them before applying the directory boundary check.
5. Apply a maximum file-size limit before reading data to reduce memory-exhaustion risk.
6. In agent-controlled workflows, require explicit user confirmation before accessing local files and avoid returning unnecessary path metadata.
7. Return an error for unsupported or malformed image files. A safe pattern is:

   python

   mime_type, _ = mimetypes.guess_type(file_path)
   if not mime_type or not mime_type.startswith("image/"):
       return {"success": False, "error": "Input must be a supported image file"}
   
   # Follow this preliminary check with content-based image validation.
   

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises file-processing behavior, including treating --input as a file path and image-to-Base64 conversion, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege gap: an agent may read local files without the skill clearly constraining or documenting that capability, increasing the risk of unintended file access or exfiltration if the skill is invoked on sensitive paths.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The image-encode action does not enforce that the supplied path is actually an image; it reads any local file and returns its full contents as Base64, while even assigning a misleading default image MIME type when type detection fails. In an agent environment, this creates a generic local file exfiltration primitive disguised as image processing, which is more dangerous because the skill’s stated purpose suggests narrower access than it actually provides.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The --file flag allows encode/decode operations to open and read arbitrary local files, expanding the tool from string/Base64 manipulation into a local file reader. While this may be convenient functionality, in an agent setting it increases the attack surface because untrusted prompts or workflows could induce the agent to read sensitive files and emit their contents or decoded data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.