Security audit
Security checks for vulnerabilities and agentic risk
The skill's image-to-action purpose is mostly clear, but it also installs persistence and silent self-updates from GitHub, which users should review before installing.
Install only if you are comfortable with a skill that may upload images or image metadata to third-party services for reverse search and that declares a silent daily self-update mechanism. Disable or remove the cron/self-update path and require explicit confirmation before public image uploads if you want tighter control.
The skill is presented primarily as an image-to-action utility, but it also declares autonomous self-update, repository retrieval, and persistent task management capabilities unrelated to that purpose. Pulling new code from a remote source and changing local state expands the trust boundary significantly and can enable supply-chain compromise or unauthorized behavior changes without a focused user request.
Self-modification is a high-risk capability because it allows the skill's behavior to change after deployment without static review of the new code. In this context, remote self-update from a repository creates a direct supply-chain avenue for malicious or accidental compromise.
## Self-update
`look.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.
A skill that silently updates itself from GitHub and restarts background tasks has a powerful and unjustified capability for its stated function. If the source repository, network path, or update mechanism is compromised, the skill can import new code and behavior without informed consent or independent review.
The repeated self-update reference indicates an intentional capability for autonomous code change. Repetition across the documentation reduces the chance this is accidental and increases concern that the skill can evolve outside its reviewed security boundary.
`look.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.
See `references/self_update.md` for the full self-update procedure.
## Visibility
The repeated self-update reference indicates an intentional capability for autonomous code change. Repetition across the documentation reduces the chance this is accidental and increases concern that the skill can evolve outside its reviewed security boundary.
`look.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.
See `references/self_update.md` for the full self-update procedure.
## Visibility
This duplicate self-update finding at the same line still reflects a real concern: the skill's documented workflow depends on a self-modifying maintenance path. Such a path is incompatible with least privilege and predictable reviewed behavior.
| `references/default_config.md` | Before initialization or config changes; when referencing default config values |
| `references/okrs.md` | Before writing or evaluating OKRs; when checking skill-level targets |
| `references/workflow.md` | Before executing the core workflow; when handling errors during processing |
| `references/self_update.md` | Before running `look.update`; when debugging self-update failures |
## Update command
This duplicate self-update finding at the same line still reflects a real concern: the skill's documented workflow depends on a self-modifying maintenance path. Such a path is incompatible with least privilege and predictable reviewed behavior.
| `references/default_config.md` | Before initialization or config changes; when referencing default config values |
| `references/okrs.md` | Before writing or evaluating OKRs; when checking skill-level targets |
| `references/workflow.md` | Before executing the core workflow; when handling errors during processing |
| `references/self_update.md` | Before running `look.update`; when debugging self-update failures |
## Update command
A declared 24-hour self-update schedule makes the self-modification persistent and automatic, substantially increasing the chance of unnoticed compromise or behavior drift. Automatic recurring code changes are especially dangerous when combined with silent execution and external network access.
This skill self-updates every 24 hours via:
look.update
A documented self-modification path is inherently risky because it allows the skill's future behavior to change outside the reviewed artifact. In this context, the capability is especially unjustified because the skill is supposed to analyze images, not alter its own installation, so the feature materially increases attack surface without serving the core function.
# Look — Self-Update Procedure
`look.update` pulls the latest package from the `source:` URL in this file's frontmatter. Runs silently — no output unless the version changed or an error occurred.
The document defines a self-update mechanism that downloads a remote package and replaces local files, which is unrelated to the skill's declared image-analysis purpose. This introduces a software installation/update channel inside the skill, expanding trust boundaries and enabling supply-chain compromise if the source repository, transport, or referenced URL is tampered with.
The procedure explicitly says it runs silently and then downloads, extracts, and overwrites local files, meaning users may be unaware that executable behavior or prompts have changed. Silent self-modification undermines transparency, consent, auditability, and incident response, and makes malicious or accidental upstream changes harder to detect before execution.
The procedure retrieves a tarball from a remote repository and copies its contents over the local installation without integrity verification or restriction to expected files. That gives a remote source effective control over local code and behavior, creating a clear path for arbitrary malicious modification through repo compromise, dependency confusion in the source URL, or unauthorized upstream changes.
Use of git reset --hard is a powerful destructive command that rewrites the working tree to match the remote branch exactly. In this context it is not command injection, but it is still a risky parameter/tool usage because it can erase local state and makes the updater capable of modifying code outside the skill's core image-routing purpose.
fi
# Apply update
git reset --hard origin/main 2>/dev/null || { echo "ERROR: Failed to reset to remote" >&2; exit 1; }
echo "Updated Look from ${LOCAL:0:8} to ${REMOTE:0:8}"
The README advertises reverse image search using Google and Yandex but does not disclose that submitted image URLs, image contents, or derived metadata may be sent to third-party services. For a skill centered on user-provided images, this creates a meaningful privacy risk because users may submit sensitive personal, location, document, or receipt images without understanding that external providers will receive them.
The README describes ingesting images with optional EXIF and device pre-parse but does not warn that EXIF can contain GPS coordinates, timestamps, device identifiers, and other sensitive metadata. In this skill's context—processing receipts, documents, places, and civic reports—that omission increases the chance that highly sensitive metadata will be collected or acted on without informed user awareness.
The warning and description explicitly say the skill is only for converting user-provided images into action drafts and is not for generic OCR or general vision tasks. Later usage guidance says to use it for 'screenshot analysis and OCR' and 'when any skill needs image understanding,' which directly conflicts with the earlier intent statements.
The trigger phrases are broad for a skill that claims narrow applicability and already has a documented false-trigger history. Overbroad triggers can cause the skill to activate on unrelated image requests, exposing private content to extra processing paths such as OCR, reverse search, or external uploads.
The manifest says the skill is not for generic OCR or general image analysis, but the usage section broadens it to screenshot analysis, OCR, visual verification, and image understanding for other skills. This scope expansion can cause accidental invocation in contexts the user did not intend, increasing exposure of sensitive images and allowing the skill to exercise more capabilities than advertised.
Internally inconsistent activation guidance makes it easier for the skill to be invoked in contexts beyond its intended boundary. In a skill that can perform external searches and persistent operations, ambiguity around when it should run increases the chance of privacy-impacting or unnecessary processing.
The workflow directs local files to be uploaded to Imgur to obtain a public URL for reverse image search, but it does not require a clear user-facing privacy warning or explicit consent. Publicly uploading user-provided images can disclose sensitive personal, financial, or document data to third parties and may create durable exposure outside the platform.
Initialization and operational sections add package installation, cron registration, and self-update mechanics that are unrelated to image-to-action drafting. These capabilities expand the skill from a content-processing tool into a persistent, self-modifying component, which materially increases attack surface and operational risk.
Registering a persistent cron job is unnecessary for one-shot image analysis and drafting, and it grants the skill ongoing execution outside the original user interaction. Persistence increases the risk of unnoticed network activity, silent updates, and data processing beyond the user's expectation.
Installing Python packages during skill setup introduces supply-chain and environment-modification risk that is not justified by the declared user-facing purpose. Dynamic dependency installation can pull unreviewed code, alter runtime behavior, and create reproducibility and integrity problems.
The skill states that it silently pulls code from GitHub unless a version change or error occurs, providing no meaningful user warning about automatic code changes. Silent code replacement undermines informed consent, auditability, and change control, especially in a skill with network and persistence capabilities.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
## look.execute.action
Inputs: draft_id, explicit confirmation token.
Outputs: ExecutionReceipt, DecisionRecord(execute). Rejects high-risk without confirmation.
## look.rollback.action
Inputs: execution_id.
No suspicious patterns detected.