ClawHub
Back to skill

Security audit

Local Image Upscaler

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate local image upscaling, inspection, and compression skill, with disclosed downloads, local file processing, and no evidence of hidden data theft or persistence.

Install only if you are comfortable with a skill that downloads and runs a pinned native image-processing runtime. Keep IMAGE_UPSCALER_CACHE and IMAGE_UPSCALER_MIRRORS pointed to trusted locations, run it only on intended image folders, and prefer offline mode after setup when network access is not needed.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Warning
Location
scripts/upscale.py:156
Finding

macOS System Utility Can Be Hijacked Through PATH

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup.py:124
Finding

Execution-Time Integrity Verification Does Not Cover the Complete Extracted Runtime

Content
View full analysis
Path: spec = manifest["platforms"][platform_key] version = manifest["runtime_version"] runtime_dir = root / "runtime" / version / platform_key executable = runtime_dir / spec["archive_root"] / spec["executable"] if executable.exists() and not force: if sha256(executable) == spec["executable_sha256"]: print(f"Using verified runtime cache: {executable}") return executable print(f"Runtime cache failed executable verification; restoring: {executable}") archive = root / "downloads" / f"runtime-{version}-{platform_key}.zip" download_verified(spec["url"], spec["sha256"], archive, manifest, offline) safe_extract_zip(archive, runtime_dir) if not executable.exists(): raise RuntimeError(f"Runtime archive did not contain {spec['executable']}") actual_executable_hash = sha256(executable) if actual_executable_hash != spec["executable_sha256"]: raise RuntimeError( "Extracted runtime executable failed SHA-256 verification: " f"expected {spec['executable_sha256']}, got {actual_executable_hash}" ) if os.name != "nt": executable.chmod(executable.stat().st_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH) return executable ``` Before execution, `upscale.py` similarly validates only the primary runtime executable and selected model files: ```python actual_runtime_hash = sha256(executable) if actual_runtime_hash != runtime_spec["executable_sha256"]: raise RuntimeError( "Runtime executable failed SHA-256 verification. Refusing to exec ...[truncated 3018 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description presents a broad image tool focused on upscaling, inspection, and compression with multiple enhancement modes and output-size/resolution controls. The supplied code chunk is much narrower: it compresses images to a target file size, using JPEG re-encoding and optional downscaling to meet the byte limit. It does support some declared aspects, such as local operation on macOS/Windows, supported JPG/PNG/WebP inputs, aspect-ratio-preserving resizing, strict target file sizes, and batch folder processing. However, the primary advertised capabilities around upscaling, enhancement algorithm/profile selection, resolution-targeted enlargement, and inspection are absent from this code. Because the actual behavior is a limited compression-only utility rather than the broader described upscale/inspect/compress tool, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code substantially matches the core declared purpose of local image upscaling on macOS/Windows: it handles JPG/PNG/WebP inputs, supports batch folders, preserves aspect ratio via long-edge scaling, offers profile/model selection, targets 1K/2K/4K/8K or custom max edge, uses cached local runtime/model assets, and verifies runtime/model integrity with SHA-256 before execution. However, the description also claims capabilities that are not present in this code chunk. Most notably, there is no mechanism to compress an image to a strict target file size such as 200KB; the only compression-related option is a simple quality/compression parameter passed to the upscaler or JPEG save routine, without iterative size targeting. Likewise, 'verified download fallbacks' are not implemented here; the script only checks for missing/integrity-failed cached assets and tells the user to run setup, rather than downloading or falling back itself. Finally, while the script reads and prints image dimensions during processing, it is not really an image inspection utility on its own. So this is a partial mismatch: the primary purpose is mostly accurate, but important declared features are absent from the supplied code chunk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill describes capabilities that require shell, filesystem, environment-variable, and network access, but it does not declare an explicit tool scope or permissions boundary. That omission can cause the agent to run with broader-than-necessary privileges, increasing the blast radius if the skill is misused, the referenced scripts are unsafe, or untrusted inputs influence shell/file/network operations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 52)May include surrounding context.

python
"-s", "format", "jpeg", "-s", "formatOptions", str(quality),
            str(source), "--out", str(destination),
        ]
        result = subprocess.run(command, check=False, stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
        if result.returncode != 0:
            raise RuntimeError(f"macOS JPEG encoding failed: {result.stderr.decode(errors='replace').strip()}")
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compress.py (reported line 83)May include surrounding context.

python
"IC_HEIGHT": str(height),
            "IC_QUALITY": str(quality),
        })
        result = subprocess.run(
            [str(trusted_windows_powershell()), "-NoProfile", "-NonInteractive", "-Command", script],
            check=False,
            env=environment,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upscale.py (reported line 166)May include surrounding context.

python
if output_format == "jpg":
            command.extend(["-s", "formatOptions", str(quality or 95)])
        command.extend([str(source), "--out", str(destination)])
        completed = subprocess.run(command, check=False, stdout=subprocess.DEVNULL)
        if completed.returncode != 0:
            raise RuntimeError(f"macOS exact resize failed with code {completed.returncode}")
        return

Tainted flow: 'command' from os.environ.get (line 257, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/upscale.py (reported line 166)May include surrounding context.

python
if output_format == "jpg":
            command.extend(["-s", "formatOptions", str(quality or 95)])
        command.extend([str(source), "--out", str(destination)])
        completed = subprocess.run(command, check=False, stdout=subprocess.DEVNULL)
        if completed.returncode != 0:
            raise RuntimeError(f"macOS exact resize failed with code {completed.returncode}")
        return

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upscale.py (reported line 206)May include surrounding context.

python
"IU_FORMAT": output_format,
            "IU_QUALITY": str(quality or 95),
        })
        completed = subprocess.run(
            [str(trusted_windows_powershell()), "-NoProfile", "-NonInteractive", "-Command", script],
            check=False,
            env=environment,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/upscale.py (reported line 265)May include surrounding context.

python
]
        if args.tta:
            command.append("-x")
        completed = subprocess.run(command, check=False)
        if completed.returncode != 0:
            raise RuntimeError(f"Upscaler exited with code {completed.returncode}")
        if dimensions:

Tainted flow: 'command' from os.environ.get (line 257, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/upscale.py (reported line 265)May include surrounding context.

python
]
        if args.tta:
            command.append("-x")
        completed = subprocess.run(command, check=False)
        if completed.returncode != 0:
            raise RuntimeError(f"Upscaler exited with code {completed.returncode}")
        if dimensions:

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring says it will 'Upscale one image or a folder of images', which suggests a narrower operation. In practice, the code also performs exact resizing after 4x processing, converts between PNG/JPG/WebP, and applies compression/quality controls via resize_exact and output-format handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This code creates output directories and later writes generated image files, which affects user data on disk. Although the script prints progress messages during processing, there is no upfront user-facing warning in comments, docstrings, or prompts that running the skill will create new files and folders.

Content

No source excerpt is available for this finding.