Privacy Mask

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:14 AM UTC
• Version: 0.3.5

Overview

This privacy redaction skill has a legitimate purpose, but it relies on unpinned external code and an automatic image-processing hook whose script is missing from the reviewed artifact.

Review before installing. Use this only if you trust the privacy-mask package and publisher, preferably pin a reviewed version, and understand that the skill is intended to read and write screenshots or cached prompt images that may contain sensitive data. Keep originals and avoid enabling automatic prompt-submit masking unless that behavior is what you want.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:52

Finding

Unpinned Third-Party Package Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–55
Vulnerability Type: Unpinned Python dependencies installed from a public package index
Risk Level: Medium

Vulnerable Code

bash

1. Install via pip: `pip install privacy-mask`
2. Ensure Tesseract OCR is installed: `brew install tesseract` (macOS) or `apt install tesseract-ocr` (Linux)
3. Verify installation: `privacy-mask --version`
4. (Optional) Install NER support: `pip install privacy-mask[ner]`

Technical Analysis

The installation instructions retrieve privacy-mask and its optional NER dependencies without an exact version constraint, dependency lockfile, package hash verification, or a reviewed source artifact. Consequently, the effective code installed can change after the Skill has been audited.

This is especially sensitive because the installed CLI is expected to process screenshots containing credentials, personal information, API keys, financial identifiers, and other confidential data. Python packages can execute code during installation or later when their command-line entry points are invoked. A compromised upstream release, account takeover, or malicious transitive dependency could therefore introduce arbitrary behavior that is not represented in the audited project.

The supplied project contains only SKILL.md; it does not include the CLI implementation or dependency metadata needed to verify the behavior of the installed package. This finding identifies an unsafe dependency-management practice and does not establish that the current privacy-mask package is malicious.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or an unpinned transitive dependency.
2. The attacker publishes a modified release to the package source used by pip.
3. A user follows the Skill instructions and runs pip install privacy-mask or pip install privacy-mask[ner].
4. Pip resolves and installs th ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version, such as privacy-mask==X.Y.Z.
2. Maintain a lockfile that pins all transitive dependencies, including dependencies introduced by the ner extra.
3. Require cryptographic package hashes through a generated requirements file and install with pip install --require-hashes -r requirements.txt.
4. Document the trusted package index explicitly and disable unexpected additional indexes to reduce dependency-confusion risk.
5. Verify package signatures or provenance attestations where available, and record the reviewed source commit and artifact digest.
6. Install and execute the CLI in an isolated, least-privileged environment with network access disabled when processing confidential images.
7. Include the reviewed implementation or reproducible build metadata in the Skill package so its local-only and offline behavior can be independently verified.
8. Establish an update process in which new versions and dependency changes undergo security review before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

- Do NOT send unmasked images to any external API or cloud service
- Do NOT skip masking when detections are found — always mask before sharing
- Do NOT modify the original image unless `--in-place` is explicitly requested
- Avoid running on very large images (>10MB) without warning the user about processing time

## Anti-patterns

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation criteria include broad, common situations such as when a user sends any screenshot or mentions privacy, masking, redacting, or anonymizing. In a skill with a UserPromptSubmit hook that can modify images before API submission, vague triggers can cause the skill to activate more often than intended, leading to unexpected file processing and write operations on user data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.