Security audit

Photo Screener

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local photo-screening tool, but it needs review because it can fetch external ML model files, including a GitHub-hosted aesthetic model that is not clearly covered by the main download-consent policy.

Install only if you are comfortable with a Python tool that reads the photo paths you provide, writes a local report, and downloads ML model weights into your home cache. Prefer pre-downloading and verifying model files yourself, avoid routine --auto-download use in automated agents, and pin or checksum the external model sources if you need a stricter supply-chain posture.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill advertises and documents capabilities that require shell execution, filesystem access, environment-variable use, and network downloads, yet it declares no permissions. This creates a transparency and policy-enforcement gap: agents or users may invoke a skill with broader access than expected, increasing the chance of unintended file modification or external communication.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior says the skill downloads a MobileCLIP2-S0 model on demand, but the finding indicates it also fetches an additional aesthetic-scoring model from GitHub and relies on a separate LAION predictor. Undisclosed external downloads materially expand the supply-chain and privacy risk surface, because users and agents cannot accurately assess what code/models are retrieved or from where.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script performs an additional network download of aesthetic model weights from GitHub that is not clearly disclosed in the skill metadata/model download section, which only describes the MobileCLIP download flow. Hidden or undocumented network retrieval expands the trust boundary and can surprise users in restricted or audited environments, especially because the downloaded weights are later loaded into torch and influence execution flow.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The documentation promises that 'the model' download is confirmed with the user, but in practice only the CLIP model has that safeguard; the aesthetic model is downloaded automatically. This mismatch is dangerous because users may rely on the documented consent boundary and unintentionally permit unexpected outbound network access and model ingestion.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The setup script downloads and installs an additional aesthetic-scoring model that is not disclosed in the manifest's declared model section. This creates a supply-chain and transparency risk: operators may approve or sandbox the skill based on incomplete information, while the script retrieves extra executable model artifacts at runtime.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script performs a direct network download from GitHub, which deviates from the documented HuggingFace-mirror-only model flow. This broadens the trusted network boundary and introduces an extra supply-chain dependency that may bypass expected review, mirroring, or allowlist controls.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code automatically downloads model weights from the network and then loads them with torch without prior user confirmation at the point of action. Downloading executable-adjacent artifacts such as ML weights from a remote source without explicit consent, integrity verification, or strong provenance controls creates supply-chain risk and violates least surprise for users operating in sensitive environments.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: | --------------------------------- | --------------------------------------- | | **Interactive** (terminal) | Prompts user: "是否下载模型？[Y/n]" | | **Non-interactive** (piped/agent) | Exits with manual download instructions | | **--auto-download flag** | Downloads without confirmation | ### Manual Download
Confidence: 90% confidence
Finding: The documented `--auto-download` behavior allows model retrieval without an interactive confirmation step, which is risky in agent or automated contexts. Combined with network and shell capabilities, this can trigger unreviewed external downloads and make supply-chain exposure or unexpected bandwidth use more likely.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: - Interactive mode: prompts user for confirmation - Non-interactive mode: exits with manual download instructions - Uses HuggingFace mirror (hf-mirror.com) for China acceleration - Add --auto-download to skip confirmation metadata: openclaw: homepage: https://github.com/konanok/photo-skills
Confidence: 88% confidence
Finding: Documenting a flag specifically intended to skip confirmation normalizes unattended remote downloads. In a skill that already performs setup and model fetching, this weakens user control and can lead to automated retrieval of large or untrusted artifacts without meaningful review.

Autonomous Decision Making

Medium

Category: Excessive Agency
Content: # Keep top 50 python3 scripts/screen.py ~/data/output/thumbnails --top-k 50 # Auto-download model (skip confirmation) python3 scripts/screen.py ~/data/output/thumbnails --auto-download # Pass specific file paths instead of a directory
Confidence: 89% confidence
Finding: The usage examples promote `--auto-download`, increasing the likelihood that integrators will copy insecure defaults into production workflows. In context, the danger is amplified because the skill performs external model acquisition and setup-related actions, so unattended operation can conceal supply-chain changes or policy violations.

Static analysis

No suspicious patterns detected.