Security audit

图片处理小工具

Security checks for vulnerabilities and agentic risk

Overview

This image-processing skill is generally purpose-aligned, but it needs review because some operations can overwrite original images despite documentation saying originals are safe.

Install only if you are comfortable with local image files being read and new image outputs being written. Keep backups before batch jobs, always choose a separate output folder, avoid same-format convert without an explicit output filename, and consider pinning dependencies or using an isolated environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:25
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
rembg== ``` 2. Generate a lock file containing cryptographic hashes and install with hash verification, such as: ```bash pip install --require-hashes -r requirements.txt ``` 3. Specify and document the trusted package index rather than inheriting an arbitrary environment-level index configuration. 4. Separate the optional `rembg` dependency from the mandatory Pillow dependency so background-removal components are installed only when explicitly needed. 5. Pin the `rembg` model version and expected download location. Verify its cryptographic digest before loading it. 6. Perform dependency vulnerability scanning and periodically review pinned versions before updating them. 7. Prefer installation in an isolated virtual environment with only the filesystem and network permissions required for image processing. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/img_process.py:140
Finding: Source Images Can Be Overwritten Despite the Documented Safety Guarantee
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs '不要 undertrigger' and says essentially any image-processing request should activate this skill instead of letting the agent reason more narrowly. Overbroad triggering can cause the agent to invoke local file-processing workflows in contexts where a simpler or safer response was appropriate, increasing unintended file access, unnecessary package installation, or accidental batch operations.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill provides operational instructions to run a local Python script over user-supplied image and folder paths, which implies filesystem read capability, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing scope metadata can cause the agent to invoke the skill without clearly constrained file access, increasing the risk of overbroad access to local files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown states the adapted version is for WorkBuddy and specifically provides "全中文说明", while the skill content and invocation guidance are entirely in Chinese with no opt-in or alternative language path. This can be a language/locale policy issue when the skill is expected to serve general users without forcing a specific language.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest defines many generic image-editing triggers and explicitly instructs the system to "不要 undertrigger", which increases the chance of activating on loosely related requests. In an agent setting, overly permissive routing can lead to unintended tool use, unnecessary access to local image folders, or modification of user files without sufficient intent verification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrase "图片太大了" is broad and matches a common user complaint rather than a clear request to invoke this specific skill. This can cause over-triggering, where the agent activates image-processing behavior in ambiguous contexts and performs unintended file operations or steers the conversation away from safer/manual clarification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code file contains natural-language documentation and CLI/help text in a single language, which can violate language/locale policy when no user opt-in or alternative is provided. The file does not indicate that the tool is intended only for a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises that it runs purely locally and does not upload images, but the remove-background feature explicitly states that first use downloads a model from the network. Even if no image contents are uploaded, this is still a security-relevant mismatch because operators may rely on the 'purely local' claim in restricted or offline environments and unintentionally permit outbound network activity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The argparse descriptions, help strings, and printed user messages are all written in Chinese, and the tool offers no locale selection or opt-in. For a general-purpose skill, this is a natural-language policy concern because it imposes one language on all users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L004 将整个技能描述为“基于 Pillow，纯本地运行，不上传任何图片”，给人的整体印象是无需网络。后文 L042 明确说明 remove-bg 首次使用会联网下载模型，虽然不是上传图片，但仍与“纯本地运行”的绝对表述不一致。
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: L017 写明“这个技能只需要一个叫 Pillow 的 Python 图片库”，属于对技能依赖的明确说明。但 L034-L042 又说明 remove-bg 需要额外安装 rembg，且首次会联网下载模型，这与前述笼统表述形成直接冲突。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The parser description lists resize, format conversion, trimming, thumbnailing, compression, sharing image generation, and batch processing, but not background removal. Since the code exposes a dedicated 'remove-bg' command, the documentation shown to users understates actual behavior and creates a manifest/code-description mismatch.
Content: No source excerpt is available for this finding.