Security audit

Shopify Product Images Downloader

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but its optional WebP mode can automatically install an unpinned npm package and mutate the skill directory without clear upfront consent.

Review before installing. Use the non-WebP path if possible, or install and pin sharp yourself in a controlled environment before enabling WebP. Run the skill only against stores you trust, and avoid running it from an environment with access to sensitive internal network services.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: scripts/shopify-image-downloader.mjs:479
Finding: Automatic Installation of an Unpinned Runtime Dependency with Lifecycle Scripts Enabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/shopify-image-downloader.mjs:233
Finding: Incomplete SSRF Protection Permits Requests to Internal and Metadata Addresses
Content: View full analysis
= 16 && Number(hostname.split(".")[1]) <= 31) ) { throw new Error(`Access to private address "${hostname}" is blocked.`); } return parsed.href; } catch (err) { throw new Error(`Invalid or unsafe URL "${value}": ${err.message}`); } } ``` ```js function fetchText(url) { return new Promise((resolve, reject) => { try { validateSafeUrl(url); } catch (e) { return reject(e); } const client = url.startsWith("https") ? https : http const req = client.get(url, { headers: { "User-Agent": "Shopify-Image-Downloader/1.0" } }, (res) => { if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { const redirectUrl = new URL(res.headers.location, url).href res.resume() return resolve(fetchText(redirectUrl)) } if (res.statusCode !== 200) { res.resume() return reject(new Error(`HTTP ${res.statusCode} for ${url}`)) } let data = "" res.on("data", (chunk) => (data += chunk)) res.on("end", () => resolve(data)) }) req.setTimeout(REQUEST_TIMEOUT, () => { req.destroy(new Error(`Requ ...[truncated 2637 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script automatically installs the sharp package by invoking npm init and npm install through execSync when --webp is enabled. That causes unexpected subprocess execution and local environment modification for a downloader, and it introduces supply-chain risk because code from the package registry is fetched and installed at runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The automatic npm installation path runs package-manager subprocesses without an explicit consent gate at the moment of action and modifies the local project directory by creating package metadata and node_modules. Even if intended to improve usability, this can surprise users, change the execution environment, and expose them to dependency-install side effects.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest frames the skill as downloading product images, with optional conversion and renaming, but the code also creates a separate timestamped summary text file in the output directory. This is a behavior mismatch because it produces extra artifacts beyond the described image backup/export output.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/shopify-image-downloader.mjs:487