pixmind-image-compress

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.1.3

Overview

This cloud image compressor is purpose-aligned, but it needs Review because batch mode and remote-download handling can expose more local data or network access than users may expect.

Install only if you are comfortable uploading selected images to Pixmind/Tencent-backed cloud processing. Avoid using recursive batch mode on folders from untrusted archives or shared sources, and review outputs carefully; the publisher should add symlink confinement, explicit upload confirmation, URL allowlisting, size/time limits, and documentation for any API-base override.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: compress.js:169

Finding

Symbolic-Link Traversal Can Upload Files Outside the Selected Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: compress.js:144

Finding

Unvalidated API-Provided URL Is Fetched Without Destination or Resource Limits

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

| `--recursive` | `-r` | boolean | false | Process subdirectories |
| `--mode` | | string | url | Response: url or base64 |

## Output Rules

- Compressed files saved to `~/Downloads/compressed-images/{date}/` by default
- Original files are **never** modified or overwritten

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill requires an API key and describes outbound HTTP use, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an agent may invoke network and environment-backed behavior without a clearly constrained capability declaration, reducing reviewability and increasing the chance of unintended data exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill states that local files are read, converted to Base64, and cloud-processed, but it does not prominently warn that user images are transmitted to an external service. Because images often contain sensitive personal or business content, this can lead to inadvertent disclosure of confidential data, especially when users expect a local-only compression workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends user-supplied image data and processing parameters to a third-party remote API endpoint, but there is no indication in the code of any user disclosure, consent flow, or privacy warning. Because images often contain sensitive visual content or metadata, silent transmission to an external service creates a real privacy and data-handling risk, especially if callers assume processing is local.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: pixmind-client.js:1