T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:31- Finding
Unsafe Pipe-to-Shell Installation Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
Vision
Security checks for vulnerabilities and agentic risk
Overview
This image-analysis skill mostly does what it claims, but its installer and remote API handling create review-worthy supply-chain and privacy risks.
Install only if you trust the publisher and are comfortable sending analyzed images, screenshots, OCR content, prompts, and an API key to the configured vision provider. Avoid the remote URL installer and curl-pipe-to-bash flow, prefer a pinned reviewed release, use HTTPS-only API endpoints, and consider storing the API key outside the plaintext config file or locking down file permissions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:12- Finding
Arbitrary Remote Source Can Install Unverified Executable Skill Code
- Content
View full analysis
/dev/null || true ``` The downloaded runtime is subsequently made executable: ```bash chmod +x "$SCRIPTS_DIR/vision.js" ``` ### Technical Analysis The first installer argument is treated as a trusted base URL without validating its origin, scheme, release version, or integrity. It can provide the Skill instructions, runtime JavaScript, and configuration. The installer does not restrict downloads to an official repository or immutable revision and performs no checksum or signature verification. The retrieved `vision.js` is placed in a trusted Skill directory and marked executable. A malicious `SKILL.md` could also alter agent behavior, while a malicious configuration could redirect credentials and image data. Silently ignoring a failed `config.json` download can also leave stale configuration in place, producing a mixed installation assembled from different versions. ### Attack Path 1. An attacker convinces a user or automation process to run `install.sh` with an attacker-controlled base URL. 2. The installer downloads the attacker's `SKILL.md`, `scripts/vision.js`, and optional configuration. 3. The malicious JavaScript is stored under `~/.claude/skills/vision/scripts/`. 4. The installer marks the downloaded runtime executable. 5. The user or agent invokes the Skill through its normal documented workflow. 6. The attacker-controlled runtime executes with the user's privileges and can access supplied image paths, the configured API key, and other resources available to the process. ### Impact Assessment The immediate priv ...[truncated 371 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
README.md:8- Finding
Unpinned Third-Party Installer and Skill Source
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/vision.js:165- Finding
API Credentials and Image Data Can Be Transmitted over Plaintext HTTP
- Content
View full analysis
{ const req = transport.request(url, { method: "POST", headers: { Authorization: `Bearer ${apiKey}`, "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body), }, }, (res) => { let data = ""; res.on("data", (c) => data += c); res.on("end", () => { ``` ### Technical Analysis The endpoint is user-configurable, and the request function deliberately falls back to Node's plaintext `http` transport for any URL that is not HTTPS. No validation rejects insecure endpoints. The authorization header contains the API bearer token. The body contains the prompt and either Base64-encoded local image contents or externally hosted image URLs. When an HTTP endpoint is configured, all of this information is transmitted without transport encryption or server authentication. An attacker can exploit this through a malicious configuration suggestion, a modified downloaded configuration, or an on-path position on the user's network. ### Attack Path 1. A user configures an `http://` API endpoint, or an attacker supplies such an endpoint through a modified configuration. 2. The user invokes the Skill with a local or remote image. 3. The Skill sends the bearer token, prompt, model request, and image data over plaintext HTTP. 4. An on-path attacker captures or modifies the request. 5. The attacker reuses the API key and obtains the potentially sensitive image and prompt data. ### Impact Assessment The attacker can obtain the configured API credential and all image or prompt data submitted ...[truncated 335 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/vision.js:55- Finding
API Key Is Stored Without Enforced Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is image analysis, but the referenced behavior includes setup/installer actions, home-directory modification, permission changes, and downloading remote content with curl. That mismatch is dangerous because users or orchestrators may invoke the skill expecting passive analysis while it performs privileged local changes and fetches untrusted code/content.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/vision.js --setup
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh cp "$SCRIPT_DIR/config.json" "$SKILL_DIR/" 2>/dev/null || true else echo "错误：请提供 GitHub URL 或在 skill 目录下运行此脚本" echo "用法：curl -fsSL https://.../install.sh | bash" exit 1 fi fi
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js } // 回退到环境变量（兼容旧版本） try { require("dotenv").config({ path: path.join(SKILL_DIR, ".env") }); } catch {} if (process.env.DASHSCOPE_API_KEY) { return {
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The user-facing instructions are entirely in Chinese, and the usage example also assumes Chinese-language interaction, but the file does not offer a language choice or explain a region-specific constraint. This can violate language or locale policy when a skill implicitly requires a specific language without user opt-in.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation guidance is broad enough that ordinary conversation about images, screenshots, or attached files may trigger the skill automatically. In a vision skill that forwards image content to an external model or API, over-triggering can cause unintended transmission of sensitive images or OCR-extracted text, increasing privacy and data-exposure risk.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill documentation indicates shell and environment capabilities are required, but it does not declare any tool scope or permission boundaries. In a skill that reads local files, accepts URLs, and invokes scripts, the absence of explicit allowed-tools makes it easier for an agent runtime to overgrant capabilities or execute the skill without clear sandbox expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The example invocation hard-codes the prompt '用中文描述这张图片', which directs the skill to respond in Chinese. This is a language policy concern because the skill does not indicate that language is optional or user-selectable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill sends image data to an external vision API but does not clearly warn users that their images, potentially including sensitive screenshots or documents, leave the local environment. This creates a privacy and data-governance risk because users may unknowingly transmit confidential content to third-party services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The eval prompts exercise very broad, natural-language triggers such as asking to 'look at this image' or analyze a screenshot, which reinforces activation on common conversational phrases without clear scope boundaries or stronger attachment checks. In a vision skill, this can cause over-triggering, unintended tool use on loosely related inputs, and potentially fetching or processing user-supplied local paths or remote URLs when the model should first confirm context and authorization.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The trigger evaluation examples are very broad, everyday image-related requests and do not include meaningful activation constraints beyond general user phrasing. In an agent setting, this can cause over-triggering of the vision skill on ambiguous or routine requests, increasing unintended access to image files or attachments and expanding the skill’s operational surface unnecessarily.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script accepts an arbitrary URL argument and downloads multiple files directly into the user's skill directory without validating the source, pinning content, or warning that existing files may be overwritten. This creates a supply-chain and integrity risk: a mistyped, malicious, or compromised URL can silently replace the installed skill with attacker-controlled content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The setup flow saves the API key in a local JSON config file without warning the user about credential persistence or applying any file-permission hardening. On shared systems or backups, this can lead to unintended disclosure of the credential and subsequent unauthorized API usage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script transmits user-supplied images and prompts to a third-party remote API, but it does not provide an explicit disclosure or confirmation at send time. In a vision skill, users may assume analysis is local; this can expose sensitive screenshots, documents, or embedded secrets to an external service without informed consent.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
All user-facing prompt and expected-output examples are written only in Chinese, which can implicitly constrain the skill to a specific language or locale without stating user choice. The file does not indicate that language selection is optional or that the skill supports other languages.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All natural-language examples in the file are written in Chinese, which may imply a language-specific trigger policy without stating that other languages are supported or that Chinese-only behavior is intentional. Under the locale policy rule, forcing or implicitly constraining use to one language without opt-in can be a policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The local-install path copies files into the user's persistent skill directory and may overwrite an existing installation without confirmation or backup. While this is a lower-risk local integrity issue than the remote path, it can still cause accidental replacement of trusted files or persistence of unexpected code.
- Content
Static analysis
No suspicious patterns detected.