Image

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:54 PM UTC
• Version: 1.0.4

Overview

This image workflow skill is coherent and mostly advisory, with disclosed command examples users should run cautiously.

Use the skill for image workflow guidance, but avoid copying the npx examples directly in sensitive workspaces. Prefer locally installed, pinned tool versions with a lockfile, or run image-processing tools in a low-privilege environment. Be careful with metadata-stripping commands because some examples intentionally overwrite the input file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: commands.md:33

Finding

Unpinned npm Packages Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: commands.md, lines 33 and 110–111
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The Skill recommends executing the following commands:

bash

npx svgo input.svg -o output.svg

bash

npx sharp input.jpg --resize 1600 --webp quality=80 -o output.webp
npx sharp input.png --flatten background=white --jpeg quality=85 -o output.jpg

Technical Analysis

When the named package is unavailable locally, npx can retrieve it from the configured npm registry and execute its command. The examples do not pin exact package versions, enforce a reviewed lockfile, verify package integrity, or prevent network installation.

Consequently, the code executed by these commands can change after the Skill has been reviewed. Security depends on the integrity of the package publisher, npm registry, package-resolution configuration, DNS and network path, and all transitive dependencies. A compromised release, dependency-confusion condition, malicious registry configuration, or similar supply-chain event could cause attacker-controlled code to run.

The warning at commands.md:144 correctly states that the examples should be treated as remote code execution from the package registry. However, this warning does not mitigate the underlying execution risk.

Attack Path

1. A user asks the agent to optimize an SVG or process an image with Sharp.
2. The agent follows one of the documented npx examples.
3. The requested package is not already installed in the trusted local dependency tree.
4. npx resolves and downloads an unpinned package from the configured registry.
5. A compromised package executable, release, or transitive dependency runs with the invoking user's permissions.
6. The malicious code accesses resources available to that user, potentially reading credentials and project files, altering local data, or initiating network connections.

Impact Assessment

Successful exploitation ...[truncated 716 chars]

Remediation

View remediation

Remediation Suggestions

• Replace ad hoc registry execution with dependencies installed through a reviewed project manifest and committed lockfile.
• Pin exact reviewed versions of svgo and the intended Sharp CLI package.
• Install dependencies in a controlled build or setup step using lockfile-enforcing commands such as npm ci.
• After trusted installation, invoke local binaries directly or use npx --no-install so the command fails rather than downloading code.
• Verify lockfile integrity and package provenance in CI, and enable dependency scanning and update review.
• Configure npm to use only an approved registry and avoid executing packages from untrusted registry or proxy configurations.
• Run image-processing tools in a least-privilege sandbox or container without unnecessary credentials, sensitive mounts, or unrestricted network access.
• Clarify the exact Sharp CLI dependency because package-name ambiguity can increase package-selection and typosquatting risk.
• Retain the existing warning, but do not rely on it as the primary security control.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command uses npx svgo without pinning an exact package version, which causes code to be fetched and executed from the npm registry at runtime. That creates a supply-chain and reproducibility risk: a malicious or compromised latest release, dependency hijack, or unexpected breaking change could execute untrusted code on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

npx sharp without a pinned version may download and run the latest package from npm, which is effectively remote code execution from the package registry. In a skills file that provides ready-to-copy commands, users may execute it directly, increasing exposure to dependency compromise, typosquatting, or future package behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second npx sharp example has the same issue: it relies on an unpinned package resolved at execution time from npm. Because the skill explicitly gives shell commands for end users, this context makes the pattern more dangerous than a purely conceptual mention, even though the file also includes a warning about npx being remote-code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.