Security audit

批量图像处理工具

Security checks for vulnerabilities and agentic risk

Overview

This image-processing skill has a coherent purpose, but its executable wrappers build shell commands from unvalidated user input, creating a real arbitrary-command-execution risk.

Install only after the wrappers are hardened to avoid shell execution, validate numeric options, restrict input and output paths, and define non-overwrite behavior. Until then, do not process untrusted filenames or parameters; use a disposable workspace, explicit output directories, backups, and pinned installer versions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/rotate.js:25
Finding: OS Command Injection in Image Rotation Wrapper
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/resize.js:24
Finding: OS Command Injection in Image Resize Wrapper
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/translate.js:24
Finding: OS Command Injection in Image Translation Wrapper
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/skeleton.js:24
Finding: OS Command Injection in Image Skeletonization Wrapper
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Most instructional content, examples, and the "对 AI 这样说" section are presented only in Chinese, with no indication that other languages are supported or that Chinese is a justified locale constraint. This can violate a language/locale policy when a skill effectively requires one language without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README advertises bulk image processing and output generation but does not clearly warn that files may be created, overwritten, or modified at scale. In a skill context, missing disclosure around write behavior can lead to destructive or unexpected filesystem changes, especially during batch operations on large photo sets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add without pinning a specific version or commit, which can cause installation of whatever package/version is current at execution time. This creates a supply-chain risk because a compromised or changed upstream package could alter behavior or execute unintended code during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The local installation example still uses npx skills add without pinning the skills tool version, so the same supply-chain exposure remains even if the skill path is local. An unpinned installer can change over time or be replaced upstream, leading to unexpected code execution in the user's environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The example trigger phrases are broad natural-language requests such as 'batch process these images' and 'rotate all product images 90 degrees,' which can overlap with ordinary user instructions. In an agent environment, this increases the chance of accidental skill invocation and unintended file operations without the user explicitly selecting the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The batch workflow examples create directories, write output files, and explicitly delete temporary files (Remove-Item $temp) without a prominent warning about overwrite and deletion behavior. In an agent-driven context, users may authorize broad file operations without realizing the examples can clobber existing outputs or remove files matching unexpected names, leading to data loss or destructive actions in the wrong directory.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The natural-language instructions, examples, and invocation phrases are entirely in Chinese, including the suggested user prompts, which can impose a language-specific usage pattern without opt-in. Under SQP-3, forcing a specific language or locale without user choice is a policy concern unless the constraint is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/resize.js:52

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/rotate.js:43

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/skeleton.js:39

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/translate.js:42