Security checks for vulnerabilities and agentic risk
Overview
The skill does a legitimate image-resizing task, but its documented shell command can be unsafe if user-controlled paths or dimensions are inserted directly.
Review before installing. Use this skill only with trusted image paths and plain numeric dimensions, and prefer agents that pass ImageMagick arguments as an argument array rather than constructing a shell command from the placeholders.
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:48
Finding
Shell Command Injection Through Unquoted Parameters
Content
View full analysis
-resize "x" -background black -gravity center \
-extent x imgs/-banner-.png
```
### Technical Analysis
The documented command interpolates the source path, dimensions, base filename, and platform suffix into a shell command without requiring strict validation or safe argument handling. Several values can originate directly or indirectly from user input:
- `` is supplied by the user.
- `` and `` may come from user-requested custom dimensions.
- `` is derived from the source filename.
- `` may be derived from a requested platform or output suffix.
If an agent constructs and executes this command through a shell, shell metacharacters, command substitutions, whitespace, redirection operators, or control operators embedded in these values may alter the intended command. Quoting only `"x"` is insufficient because command substitution remains active inside double quotes. Unquoted source and output paths also permit argument splitting and shell expansion.
Option-like filenames beginning with `-` can additionally be interpreted as ImageMagick options unless arguments are appropriately delimited or otherwise validated.
### Attack Path
1. An attacker provides a crafted source path, custom dimension, filename, or platform value containing shell syntax.
2. The agent follows the Skill procedure and substitutes the attacker-controlled value into the documented command.
3. The resulting command is passed to a shell without comprehensive validation or safe argument separation.
4. The shell evaluates the injected metacharacters or command substitution.
5. The attacker-controlled command executes with the same operating-system privileges and filesystem access as the agent process.
For example, a malicious custom value
...[truncated 998 chars]
