ClawHub
Back to skill

Security audit

Libvips Image

Security checks for vulnerabilities and agentic risk

Overview

The skill is image-processing focused, but its installer can run unverified internet scripts and make system-level package changes, so it belongs in Review before installation.

Install only if you are comfortable reviewing and approving system package changes. Avoid the one-click uv bootstrap unless you separately trust and verify the uv installer; prefer a preexisting package manager, a virtual environment, pinned dependencies, and no sudo pip fallback.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:218
Finding

Unverified Remote Installer Content Is Executed Directly

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:218-230; additional unsafe instructions at SKILL.md:89-96
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

scripts/install.sh:218-230:

bash
install_uv() {
    info "Installing uv..."
    if has_cmd curl; then
        debug "Using curl to install uv"
        curl -LsSf https://astral.sh/uv/install.sh | sh
    elif has_cmd wget; then
        debug "Using wget to install uv"
        wget -qO- https://astral.sh/uv/install.sh | sh
    else
        error "Neither curl nor wget found. Install uv manually: https://docs.astral.sh/uv/"
    fi

SKILL.md:89-96:

bash
**Install uv (if not installed):**
```bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
irm https://astral.sh/uv/install.ps1 | iex
text

### Technical Analysis

The installer downloads mutable content from an external URL and passes the response directly to `sh`. The documentation also recommends the same pattern and its PowerShell equivalent, `Invoke-RestMethod | Invoke-Expression`.

The downloaded content is not pinned to a reviewed version, saved for inspection, checked against a cryptographic hash, or validated with a trusted signature. Consequently, the code that ultimately executes can change after the Skill package has been reviewed.

The `astral.sh` URL is consistent with the documented `uv` installer, and no evidence shows that it currently serves malicious content. Nevertheless, direct execution creates a remote code-execution channel. Compromise of the upstream distribution infrastructure, publishing process, DNS/TLS environment, or installer account could turn an otherwise legitimate installation step into arbitrary code execution.

Installing `uv` is not essential to the declared image-processing functionality because the installer already contains a
...[truncated 1389 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove all curl | sh, wget | sh, and irm | iex installation paths.
  2. Prefer an operating-system package manager or the existing pip fallback, avoiding the optional uv bootstrap entirely where possible.
  3. If uv must be installed:
    • Pin an explicitly reviewed release.
    • Download the release artifact to a local file.
    • Obtain the expected checksum or signature through a trusted release channel.
    • Verify the artifact before execution.
    • Abort on any verification failure.
    • Execute it without elevated privileges.
  4. Update SKILL.md so it does not instruct users to execute a live network response.
  5. Display the selected version and verified digest in installer logs.
  6. In automated environments, provision dependencies in a reviewed base image or locked setup phase rather than dynamically downloading an installer.

T08 · Insecure Dependencies

Warning
Location
pyproject.toml:7
Finding

Unpinned Dependencies and Privileged Pip Fallback Create Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: pyproject.toml:7-9, pyproject.toml:13-15, scripts/install.sh:184, scripts/install.sh:198, scripts/install.sh:253-268
Vulnerability Type: Insecure dependency management
Risk Level: Medium

Vulnerable Code

pyproject.toml:7-9:

toml
dependencies = [
    "pyvips>=2.2.0",
]

pyproject.toml:13-15:

toml
dev = [
    "pytest>=7.0.0",
]

Relevant installation commands in scripts/install.sh include:

bash
if uv pip install pyvips; then
    success "pyvips installed via uv"
    return 0
fi
bash
if $pip_cmd install --user pyvips; then
    success "pyvips installed via $pip_cmd (user)"
    return 0
fi

warn "User installation failed, trying system-wide installation..."
if sudo $pip_cmd install pyvips; then
    success "pyvips installed via $pip_cmd (system)"
    return 0
fi

Technical Analysis

The project specifies only lower version bounds and does not include a dependency lockfile or artifact hashes. The installer additionally requests pyvips without any version constraint. Each installation can therefore resolve a different current package release and a different transitive dependency set.

This makes installation results non-reproducible and allows code published after the Skill audit to enter the environment automatically. A compromised upstream package, malicious future release, dependency takeover, or vulnerable transitive dependency could consequently affect later installations.

Python package installation may invoke package build backends or other installation-time logic. Installed dependency code is also imported by both runtime tools. The sudo pip fallback increases the potential scope by writing packages into a system-level Python environment and running installation activity with elevated privileges.

No evidence was found that the current pyvips dependency is malicious. Th ...[truncated 1657 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin dependencies to explicitly reviewed versions rather than relying only on lower bounds.
  2. Commit a dependency lockfile containing exact resolved versions and cryptographic hashes.
  3. Ensure automated and production installation uses the locked dependency set.
  4. Install Python packages exclusively inside a project-specific virtual environment.
  5. Remove the sudo pip install fallback. System Python packages should be managed by the operating-system package manager.
  6. Add package provenance and integrity verification where supported.
  7. Review and update dependency pins through a controlled process that includes vulnerability scanning and testing.
  8. Keep development dependencies isolated from production installation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (37)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose is image processing, but the content also directs package installation, use of sudo, remote installer execution, and persistent environment changes. That mismatch is dangerous because it can cause users or agents to authorize broader system-level actions than expected for a simple media-processing skill.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping downloaded content directly into sh or iex creates an unsafe execution chain with no inspection boundary. In a skill context, this is especially risky because it normalizes remote-code execution as part of routine setup and can be abused if the source or transport is compromised.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

Install uv (if not installed):

bash
# macOS/Linux
curl -LsSf https://astral.sh/uv/install.sh | sh

# Windows (PowerShell)
irm https://astral.sh/uv/install.ps1 | iex

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install.sh (reported line 152)May include surrounding context.

sh
;;
        arch|manjaro|endeavouros)
            debug "Installing for Arch Linux"
            run_cmd "pacman -S --noconfirm libvips base-devel"
            ;;
        alpine)
            debug "Installing for Alpine Linux"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/install.sh (reported line 169)May include surrounding context.

sh
;;
        arch|manjaro|endeavouros)
            debug "Installing for Arch Linux"
            run_cmd "pacman -S --noconfirm libvips base-devel"
            ;;
        alpine)
            debug "Installing for Alpine Linux"

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping downloaded content into 'sh' is a classic dangerous command chain because it removes any opportunity for inspection, integrity verification, or confinement. In an installer, this directly exposes users to remote arbitrary code execution and supply-chain compromise.

Content

Scanner excerpt · scripts/install.sh (reported line 223)May include surrounding context.

sh
info "Installing uv..."
    if has_cmd curl; then
        debug "Using curl to install uv"
        curl -LsSf https://astral.sh/uv/install.sh | sh
    elif has_cmd wget; then
        debug "Using wget to install uv"
        wget -qO- https://astral.sh/uv/install.sh | sh

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

This wget-based pipe-to-shell chain has the same arbitrary execution risk as the curl-based version. The lack of pinning and verification makes the installer dependent on a mutable remote script at runtime.

Content

Scanner excerpt · scripts/install.sh (reported line 226)May include surrounding context.

sh
curl -LsSf https://astral.sh/uv/install.sh | sh
    elif has_cmd wget; then
        debug "Using wget to install uv"
        wget -qO- https://astral.sh/uv/install.sh | sh
    else
        error "Neither curl nor wget found. Install uv manually: https://docs.astral.sh/uv/"
    fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill clearly instructs users to run shell commands and wrapper scripts, but it does not declare any tool scope or allowed-tools metadata. This weakens security boundaries because an agent or user may not realize the skill requires command execution, installation steps, and environment changes.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · VALIDATION_REPORT.md (reported line 158)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · VALIDATION_REPORT.md (reported line 196)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · VALIDATION_REPORT.md (reported line 204)May include surrounding context.

Ubuntu/Debian:

bash
sudo apt-get install libvips-dev
uv pip install pyvips  # preferred
# or: pip install pyvips

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill recommends persistent shell profile modification to set DYLD_LIBRARY_PATH, which alters future sessions and can affect unrelated programs. Persistent environment changes increase risk because they expand the blast radius of misconfiguration and can unintentionally change dynamic library loading behavior.

Content

Scanner excerpt · SKILL.md (reported line 551)May include surrounding context.

macOS Library Path Setup:

bash
# Add to ~/.zshrc or ~/.bashrc
export DYLD_LIBRARY_PATH="/opt/homebrew/lib:$DYLD_LIBRARY_PATH"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · VALIDATION_REPORT.md (reported line 65)May include surrounding context.

md
| python3-dev 依赖 | 存在于脚本 | ✅ |
| build-essential 依赖 | 存在于脚本 | ✅ |
| AUTO_MODE 支持 | 环境变量处理 | ✅ |
| SKIP_SUDO 支持 | Docker 检测 | ✅ |
| VERBOSE 支持 | 调试日志函数 | ✅ |
| Docker 检测 | /.dockerenv 检查 | ✅ |
| Apple Silicon 支持 | arm64 检测 | ✅ |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The report explicitly states the installation script is 'safe', 'production ready', and can be merged without caution, even though the described script performs system-level package installation, may use sudo, modifies environment-related behavior, and installs software from package managers and pip. This can mislead users or reviewers into executing privileged setup steps without a proper security review or operational warning.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
91% confidence
Finding

The installer executes dynamically constructed command strings via 'sudo bash -c "$cmd"'. Combining root execution with eval-like command interpretation magnifies the effect of any command injection, variable manipulation, or future maintenance mistake into full privileged code execution.

Content

Scanner excerpt · scripts/install.sh (reported line 78)May include surrounding context.

sh
eval "$cmd"
    else
        debug "Running (with sudo): $cmd"
        sudo bash -c "$cmd"
    fi
}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/install.sh (reported line 152)May include surrounding context.

sh
;;
        arch|manjaro|endeavouros)
            debug "Installing for Arch Linux"
            run_cmd "pacman -S --noconfirm libvips base-devel"
            ;;
        alpine)
            debug "Installing for Alpine Linux"

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/install.sh (reported line 169)May include surrounding context.

sh
;;
        arch|manjaro|endeavouros)
            debug "Installing for Arch Linux"
            run_cmd "pacman -S --noconfirm libvips base-devel"
            ;;
        alpine)
            debug "Installing for Alpine Linux"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script offers to install uv but does not clearly warn that doing so will fetch and execute network-delivered shell code. Users may interpret this as a normal package installation prompt and consent without understanding that arbitrary shell commands from a remote source will run locally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer downloads and immediately executes a remote shell script from astral.sh to install uv. This creates a supply-chain and arbitrary code execution risk because any compromise of the remote host, transport, or script contents results in code execution on the user's machine, and the behavior is broader than the skill's core image-processing purpose.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

Falling back to 'sudo $pip_cmd install pyvips' performs a root-level Python package installation from package indexes. This increases system-wide supply-chain risk and can modify the global Python environment, making compromise of package sources or dependency confusion more damaging.

Content

Scanner excerpt · scripts/install.sh (reported line 268)May include surrounding context.

sh
# Fallback to system installation if user install fails
                warn "User installation failed, trying system-wide installation..."
                if sudo $pip_cmd install pyvips; then
                    success "pyvips installed via $pip_cmd (system)"
                    return 0
                fi

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_vips_tool.py (reported line 42)May include surrounding context.

python
def run_command(args: list, expected_success: bool = True) -> tuple:
    """Run vips_tool.py command and return result."""
    cmd = [sys.executable, str(script_dir / "vips_tool.py")] + args
    result = subprocess.run(cmd, capture_output=True, text=True)

    success = result.returncode == 0
    if expected_success and not success:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest describes resizing, converting, watermarking, thumbnails, and batch image operations, which suggests batch orchestration of those listed tasks. The pipeline code also supports sharpening, blurring, grayscale conversion, rotation, flipping, and brightness/contrast adjustment, which are broader general-purpose editing capabilities not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 560)May include surrounding context.

md
print("Error: pyvips not installed. Run: pip install pyvips")
    print("Also ensure libvips is installed:")
    print("  macOS: brew install vips")
    print("  Ubuntu: sudo apt-get install libvips-dev")
    sys.exit(1)

Static analysis

No suspicious patterns detected.