T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:115- Finding
Unnecessary Worker-Session Inspection and Root-Level Host Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Batch Image Processing
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real batch image-processing helper, but it also normalizes privileged remote SSH workflows that users should review before installing.
Install only if you are comfortable with an agent performing bulk file writes and possibly remote SSH operations. Do not use the documented root SSH or StrictHostKeyChecking=no pattern as-is; require explicit hosts and paths, a restricted non-root account, strict known_hosts verification, and user confirmation before remote execution or directory moves.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:170- Finding
SSH Server Authentication Disabled for Automated Root Connections
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码与“批量图片压缩”以及“断点续传（跳过已存在文件）”基本一致，也确实涉及一定程度的格式转换，因为所有输入最终都被保存为 JPEG。但声明描述的能力范围明显更大：它暗示支持通用格式转换、目录重组、以及 jpegoptim 和 Pillow 之间的选择，还覆盖远程服务器批量处理。实际代码没有这些能力；目录方面只是复制原有相对路径，而非重组；格式转换也不是通用可配置，而是固定转成 JPEG。由于声明的多个核心能力在代码中缺失，描述不能准确代表该代码块的实际行为。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill metadata and the entire user-facing guidance are written as Chinese-only instructions, with no indication that the user may choose another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill includes SSH/SCP-based remote execution guidance even though its stated purpose is batch image processing. Expanding from local file handling to remote command execution materially increases attack surface and can lead an agent to access external hosts, transfer files, or run commands on infrastructure without sufficiently explicit authorization boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation instructs users to disable SSH host key checking for automation without warning about the trust implications. This makes man-in-the-middle attacks far easier, allowing an attacker who can intercept traffic or spoof a host to capture credentials, serve malicious content, or execute commands on the wrong system.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code file contains natural-language instructions and status messages entirely in Chinese, starting with the module docstring. The policy for this category flags language/locale constraints when the skill forces a specific language without user opt-in, and there is no indication that this script is intentionally region-specific or that another language is available.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest and module docstring describe batch image processing including format conversion, but the implementation unconditionally saves every processed image with format="JPEG". Because the output path keeps the original relative filename and suffix, files such as .png or .webp are actually rewritten as JPEG content without a corresponding declared conversion interface or correct extension handling.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code rewrites all discovered source images into new JPEG outputs, which can irreversibly remove transparency, animation frames, and original format fidelity. Although the script prints progress, its docstring and user-facing messages do not warn that conversion to JPG is lossy and creates/overwrites output files under a fixed destination directory.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 62% confidence
- Finding
The reorganization workflow describes execution via "os.rename() 原子操作", implying a straightforward safe primitive, but later documentation states os.rename fails in important real cases and recommends external mv instead. This is not merely incomplete detail; it presents a stronger guarantee than the documented behavior actually supports.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest focuses on image processing tasks, but this section advises invoking an external system command via subprocess to move directories. Spawning external commands is a broader execution capability than the stated image-processing purpose and is not clearly justified in the manifest itself.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The docstring describes a batch image recompression tool that processes images into JPG output, which implies converting the input images as images rather than partially discarding content. In code, files with multiple frames are handled by seeking only frame 0 at L032-L033, so animated GIF/WebP/TIFF inputs are silently flattened to a single frame.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script's natural-language interface and documentation strings are entirely in Chinese, including usage and status messages. This imposes a specific language on users without any opt-in or alternative locale, which matches the language/locale policy concern.
- Content