ClawHub
Back to skill

Security audit

skill-image-compress

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real image compressor, but its setup path includes unsafe privileged install guidance that users should review before installing.

Install only if you are comfortable with a Node/sharp-based local image tool that runs npm install and processes files or folders you select. Do not copy the Linux curl | sudo bash Node installation commands from its environment output; use official Node.js or OS package-manager instructions instead. Prefer reviewing and pinning dependencies with a lockfile before use.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/detect-env.js:43
Finding

Privileged Remote Script Execution Recommended Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:6
Finding

Non-Reproducible Installation of Mutable npm Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill is presented as an image compression utility, but it also performs environment discovery and installation guidance involving system-level command execution. That mismatch matters because users may consent to image processing without realizing the skill can inspect local development tooling and trigger dependency installation flows, expanding the attack surface beyond the stated purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as an image compression utility, but it also performs environment discovery and installation guidance involving system-level command execution. That mismatch matters because users may consent to image processing without realizing the skill can inspect local development tooling and trigger dependency installation flows, expanding the attack surface beyond the stated purpose.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
node scripts/detect-env.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
node scripts/install.js

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md
node scripts/compress.js ~/Pictures/photo.png --quality 0.8

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
node scripts/compress.js ~/Pictures/photo.png --quality 0.8

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 194)May include surrounding context.

md
node scripts/compress.js ~/Pictures/photo.png --quality 0.8

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
.option('-r, --recursive', '递归处理子文件夹', false)
    .option('-o, --outputDir <dir>', '输出目录', '')
    .option('-p, --preset <preset>', '压缩预设 (web, wechat, email, quality)', '')
    .option('--no-confirm', '跳过确认提示', false)
    .action(compress);
  
  program.parse();

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/compress.js (reported line 46)May include surrounding context.

js
.option('-r, --recursive', '递归处理子文件夹', false)
    .option('-o, --outputDir <dir>', '输出目录', '')
    .option('-p, --preset <preset>', '压缩预设 (web, wechat, email, quality)', '')
    .option('--no-confirm', '跳过确认提示', false)
    .action(compress);
  
  program.parse();

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

Piping network data directly into sudo is a classic high-risk pattern because it executes unaudited remote content with administrative privileges. The danger is amplified here by sudo -E, and by the likelihood that users will copy the exact command from the tool’s output.

Content

Scanner excerpt · scripts/detect-env.js (reported line 44)May include surrounding context.

js
},
    linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

Piping network data directly into sudo is a classic high-risk pattern because it executes unaudited remote content with administrative privileges. The danger is amplified here by sudo -E, and by the likelihood that users will copy the exact command from the tool’s output.

Content

Scanner excerpt · scripts/detect-env.js (reported line 44)May include surrounding context.

js
},
    linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The curl ... | sudo bash pattern is dangerous because it collapses download and privileged execution into a single opaque step. If the downloaded content is malicious or tampered with, it can immediately obtain root-level code execution on the user’s system.

Content

Scanner excerpt · scripts/detect-env.js (reported line 45)May include surrounding context.

js
linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }
  };

Chaining Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The curl ... | sudo bash pattern is dangerous because it collapses download and privileged execution into a single opaque step. If the downloaded content is malicious or tampered with, it can immediately obtain root-level code execution on the user’s system.

Content

Scanner excerpt · scripts/detect-env.js (reported line 45)May include surrounding context.

js
linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }
  };

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill clearly instructs the agent to invoke shell commands such as node scripts/detect-env.js, node scripts/install.js, and npm install, but it does not declare any permissions or allowed-tools scope. This creates a trust-boundary problem where a nominally simple image utility can execute host commands without explicit capability declaration, increasing the risk of unexpected command execution and making review and policy enforcement harder.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/technical.md (reported line 143)May include surrounding context.

md
### Linux

- Install dependencies: `sudo apt-get install libvips-dev`
- May need `libimagequant-dev` for PNG

## Configuration Schema

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's natural-language interface, including CLI descriptions, prompts, errors, and status messages, is hard-coded in Chinese throughout the file. This forces a specific language on users without opt-in or documented regional justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
.option('-r, --recursive', '递归处理子文件夹', false)
    .option('-o, --outputDir <dir>', '输出目录', '')
    .option('-p, --preset <preset>', '压缩预设 (web, wechat, email, quality)', '')
    .option('--no-confirm', '跳过确认提示', false)
    .action(compress);
  
  program.parse();

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
65% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/compress.js (reported line 46)May include surrounding context.

js
.option('-r, --recursive', '递归处理子文件夹', false)
    .option('-o, --outputDir <dir>', '输出目录', '')
    .option('-p, --preset <preset>', '压缩预设 (web, wechat, email, quality)', '')
    .option('--no-confirm', '跳过确认提示', false)
    .action(compress);
  
  program.parse();

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Batch mode forces noConfirm: true for every file, bypassing the only large-file warning path and proceeding directly to write outputs. In recursive directory processing, this can trigger substantial CPU, memory, and disk consumption on many large files without an effective per-item or aggregate user acknowledgment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest explicitly says the skill does not handle file management and is for image compression/format conversion only, but the implementation reads a config file from the user's home workspace and defaults output into a managed Downloads folder structure. While writing compressed images is expected, maintaining dated output directories and consulting external configuration expands behavior beyond the narrowly described image-only operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file contains natural-language comments and console messages in Chinese, and all user-facing status and installation guidance later in the script also assume Chinese. Because the skill does not offer a language/locale choice or state that it is intentionally limited to a Chinese-speaking context, this is a language-policy issue under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

Using sudo -E is especially risky because it preserves user-controlled environment variables while invoking a privileged shell on remotely sourced content. That combination can magnify exploitation paths and is unnecessary for simple user guidance in an environment detection script.

Content

Scanner excerpt · scripts/detect-env.js (reported line 44)May include surrounding context.

js
},
    linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

Using sudo -E is especially risky because it preserves user-controlled environment variables while invoking a privileged shell on remotely sourced content. That combination can magnify exploitation paths and is unnecessary for simple user guidance in an environment detection script.

Content

Scanner excerpt · scripts/detect-env.js (reported line 44)May include surrounding context.

js
},
    linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
88% confidence
Finding

The CentOS/RHEL guidance includes sudo bash - for a remotely fetched setup script, encouraging execution of unverified code as root. In a skill context, users may trust and paste the command blindly, turning documentation text into a practical path for system compromise.

Content

Scanner excerpt · scripts/detect-env.js (reported line 45)May include surrounding context.

js
linux: {
      official: 'https://nodejs.org/en/download',
      ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_lts.x | sudo -E bash - && sudo apt-get install -y nodejs',
      centos: 'curl -fsSL https://rpm.nodesource.com/setup_lts.x | sudo bash - && sudo yum install -y nodejs',
      description: 'Linux'
    }
  };

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency uses a caret range (^12.1.0), which allows automatic installation of newer minor/patch releases instead of a fully fixed version. This weakens build reproducibility and can unexpectedly introduce a vulnerable or malicious upstream release through normal dependency resolution.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Cross-platform image compression skill",
  "type": "module",
  "dependencies": {
    "commander": "^12.1.0",
    "sharp": "^0.33.5"
  }
}

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/detect-env.js:16

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/install.js:21