ClawHub
Back to skill

Security audit

Reverse Image Search

Security checks for vulnerabilities and agentic risk

Overview

This reverse image search skill is purpose-aligned and user-directed, but users should understand that local images may be uploaded to external search providers and the Python dependency is installed unpinned.

Install and run this only in an environment where it is acceptable to send the chosen image or image URL to Yandex, Google, or Bing. Avoid confidential, internal, or metadata-sensitive images unless you have consent and have considered stripping metadata. For stronger security, pin and review PicImageSearch and its transitive dependencies before installation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-17
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code:

bash
## Setup

On first use, create a Python venv and install the dependency:

```bash
SKILL_DIR="$(dirname "SKILL.md")"
python3 -m venv "$SKILL_DIR/scripts/.venv"
"$SKILL_DIR/scripts/.venv/bin/pip" install -q PicImageSearch
text

### Technical Analysis

The setup instructions install `PicImageSearch` without an exact version, a cryptographic hash, or a reviewed lockfile. Consequently, installation resolves whichever package release and transitive dependencies are available from the configured Python package index at setup time.

The installed package is subsequently imported by `scripts/search.py`. That script also places the virtual environment's `site-packages` directory at the beginning of `sys.path`, causing code from the newly installed package to be loaded when the Skill runs. Python packages can execute arbitrary code during installation and module import.

This creates a supply-chain exposure: a compromised future release, compromised package-index account, malicious dependency substitution, or altered transitive dependency could introduce executable code after the Skill itself has been reviewed. The audit found no evidence that the currently referenced package is malicious; the vulnerability is the absence of reproducible dependency controls.

### Attack Path

1. An attacker compromises the `PicImageSearch` distribution, one of its transitive dependencies, or the package-index account used to publish it.
2. The attacker publishes a malicious release that satisfies the unbounded dependency request.
3. A user follows the documented first-use setup command.
4. `pip install -q PicImageSearch` retrieves and installs the attacker-controlled release without checking an expected version or hash.
5. When `scripts/search.py` runs, it prepends the v
...[truncated 879 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin PicImageSearch and every transitive dependency to audited, exact versions in a requirements lockfile.
  2. Record cryptographic hashes for every permitted distribution and enforce them with:
    bash
    pip install --require-hashes -r requirements.txt
  3. Generate the lockfile from a trusted environment and review it before distribution.
  4. Explicitly configure and document the trusted package index rather than relying on ambient pip configuration.
  5. Use a dependency scanner and periodically review pinned versions for published vulnerabilities.
  6. Test upgrades separately and update pins and hashes only after reviewing release provenance and behavior.
  7. Run installation and execution as a least-privileged user in an isolated environment without unnecessary credentials or filesystem access.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
SKILL_DIR="$(dirname "SKILL.md")"

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
SKILL_DIR="$(dirname "SKILL.md")"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly supports sending image URLs and local files to Yandex, Google, and Bing, but it does not warn users that their provided content may be transmitted to third-party services. This creates a privacy and data-handling risk: sensitive local images, internal URLs, or confidential visual data could be disclosed externally without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

When a local path is supplied, the script uploads the file contents to third-party reverse-image search providers, which may expose sensitive images or embedded metadata to external services without explicit user acknowledgement. In this skill context, handling user-provided local files is central functionality, which makes the privacy risk more significant because users may not realize their local image is being transmitted off-device.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/search.py (reported line 45)May include surrounding context.

python
"source_engine": engine_name,
        }
        for attr in ("similarity", "size", "source", "content"):
            val = getattr(item, attr, None)
            if val:
                r[attr] = str(val)[:300]
        if r["url"]:

Static analysis

No suspicious patterns detected.