Image Works

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent local batch image processor, with ordinary local file risks users should manage before running it.

Install only if you are comfortable with a local tool reading the image paths you provide and writing processed files. Use a private output directory, keep overwrite disabled unless you intend replacement, avoid shared or world-writable output folders, and do not run extreme resize dimensions or untrusted image batches without resource limits. Also note the manifest declares a DeepSeek model despite the local-processing framing.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: schemas/input.schema.json:21

Finding

Unbounded Image Dimensions Permit Resource-Exhaustion Denial of Service

Content

View full analysis

Remediation

View remediation

None: if width < 1 or height < 1: raise ValueError("Image dimensions must be positive") if width > MAX_DIMENSION or height > MAX_DIMENSION: raise ValueError("Image dimension exceeds the permitted maximum") if width * height > MAX_PIXELS: raise ValueError("Output image exceeds the permitted pixel count") ``` 3. Calculate final dimensions first and validate them before every `resize()`, crop, canvas creation, or conversion operation. 4. Configure Pillow's decompression-bomb protection and reject source images that exceed an explicit input-pixel policy. 5. Run image processing with operating-system memory, CPU, and execution-time limits so malformed or extreme jobs cannot affect unrelated services. 6. Add tests for zero, negative, extremely large, and overflow-adjacent values, including combinations where individually acceptable dimensions exceed the total-pixel limit. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/processor.py:151

Finding

Overwrite Mode Follows Attacker-Controlled Destination Symbolic Links

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill performs local batch image processing operations. However, this code chunk only aggregates existing result data into a report and formats that report as text. It reads no image files, performs no image manipulation, and does not implement the listed processing capabilities. While reporting could be a supporting component of a larger image-processing skill, this supplied code chunk’s actual behavior is materially different from the declared primary purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose says this skill performs batch image processing operations locally. However, the supplied code chunk is only a scanner/helper module that discovers image files and reports file info. Its primary behavior is input discovery and metadata inspection, not compression, resizing, format conversion, watermarking, EXIF cleaning, or cropping. While file discovery could be a supporting component of an image-processing skill, this chunk by itself materially differs from the declared functionality because none of the promised processing capabilities are implemented here.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

| `--preset` | string | — | Platform preset (overrides --op) |
| `--output.dir` | string | `./processed/` | Output directory |
| `--output.suffix` | string | `''` | Filename suffix |
| `--output.overwrite` | bool | false | Overwrite existing files |
| `--output.keep-structure` | bool | true | Preserve original dir structure |
| `--recursive` | bool | false | Scan subdirectories |
| `--max-files` | int | 1000 | Maximum files to process |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/processor.py (reported line 26)May include surrounding context.

python

operations: List of operation dicts.
        output_dir: Base output directory.
        suffix: Filename suffix (e.g., '_compressed').
        overwrite: Whether to overwrite existing files.
        keep_structure: Whether to preserve relative directory structure.
        base_input_dir: Base input directory for relative path preservation.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises local batch processing over user-supplied paths and references scanner/processor scripts, which implies filesystem access, but it does not declare any explicit tool scope or permissions. Missing scope declarations weaken least-privilege controls and can cause reviewers or runtime policy systems to underestimate the file-read surface.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

author: Golden Bean (coder)
category: Multimedia
description: Batch image processing - compress, resize, format convert, watermark, EXIF clean, and crop. All local, no upload needed.
model: deepseek/deepseek-v4-flash
input_schema: schemas/input.schema.json
output_schema: schemas/output.schema.json
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This JSON schema is a manifest-scoped file type, so vague-trigger checks apply. The description "Input parameters for image-works skill" and the input description "File paths, directories, or glob patterns" describe accepted data but provide no specific invocation phrases, scope limits, or exclusion conditions, making activation boundaries unclear.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This JSON manifest contains user-facing preset names entirely in Chinese (for example, 微信朋友圈9宫格, 公众号封面, 小红书笔记图, 淘宝主图, 抖音封面, 通用头像) with no indication that the skill is region-specific or that users can choose another language. That creates a natural-language locale policy concern because the file implicitly enforces a specific language for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The preset enum includes region- or platform-specific options such as "wechat-moments", "xiaohongshu", and "douyin-cover". While not inherently problematic, the file provides no natural-language indication that these locale-specific presets are optional or justified, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The preset names include locale-specific platforms such as WeChat, Xiaohongshu, Taobao, Douyin, Weibo, and Bilibili, which indicates the skill may steer usage toward a specific regional ecosystem. Under the language/locale policy rule, hard-coded locale-specific behavior should be user-selectable or explicitly justified rather than assumed by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The module docstring states that the presets are for Chinese social platforms, and multiple preset names and labels are hard-coded in Chinese throughout the file. Because the file provides no user opt-in, alternative locale, or explicit justification that the skill is region-specific, this can be read as a locale policy constraint embedded in natural-language content.

Content

No source excerpt is available for this finding.