Security audit

Image-2 Skill

Security checks for vulnerabilities and agentic risk

Overview

This image skill does what it claims, but it under-discloses that user prompts and local images are sent to OpenAI and incorrectly suggests images are not kept off-device.

Review before installing if you may use confidential, personal, regulated, or proprietary images. The skill needs your OpenAI API key, sends prompts and selected local images or URLs to OpenAI for processing, and saves outputs locally by default; use only approved content and verify output paths.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The README states that no images are stored on external servers, but the skill depends on OpenAI's remote image API, which necessarily transmits user prompts and image data to an external service for processing. This is a misleading privacy/security claim that can cause users to share sensitive images or data under false assumptions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README markets the skill's capabilities without clearly warning that user prompts and images are sent to an external API provider. This lack of transparency creates privacy and compliance risk, especially if users provide confidential, personal, or regulated content believing processing is local.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The README describes image editing features such as removing backgrounds, adding elements, and extending images, but does not warn users that these operations can alter original content if workflows overwrite source files or are used incautiously. While the README alone does not prove destructive behavior, omitting this caution increases the chance of accidental data loss or unintended modification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to download generated images and save them locally by default, but the user-facing description does not clearly warn that files will be written into the project directory. This can lead to unexpected persistence of potentially sensitive or regulated image content on disk, increasing privacy and data retention risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill supports editing and analysis of user-provided image files or URLs via external OpenAI APIs, but it does not clearly disclose that those inputs are transmitted to a third-party service. Users may unknowingly send private images, internal screenshots, or signed URLs containing sensitive data to an external processor.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This function reads a local image (and optional mask), converts it to base64, and sends the content to a remote API. That creates a real data exposure risk if callers pass sensitive local files, especially because the function accepts arbitrary paths/URLs and performs the upload implicitly as part of an edit operation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: When given a local file path, the code base64-encodes the image and transmits it to the remote model for analysis. In a skill context, this is security-relevant because users may not realize local images are being uploaded off-host, potentially exposing confidential screenshots, documents, or personal photos.

Static analysis

No suspicious patterns detected.