ClawHub
Back to skill

Security audit

Screenshot Stitcher

Security checks for vulnerabilities and agentic risk

Overview

This skill is narrowly focused on local screenshot stitching, with the main caution being its unpinned PyPI CLI install.

Install the CLI in a dedicated virtual environment when possible, prefer a pinned and reviewed package version, and only process screenshots you are comfortable making available to local tooling in that Python environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:19
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–27
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash
pip install screenshot-stitcher
screenshot-stitcher --help
bash
python -m pip install screenshot-stitcher
screenshot-stitcher --help

Technical Analysis

The skill directs the agent to install screenshot-stitcher from PyPI without pinning an exact version or verifying package hashes. As a result, the installed implementation may change independently of this reviewed skill. Package-controlled code may run during installation, and the subsequent CLI invocation executes package-controlled runtime code.

The external package source is not included in this project, so its behavior cannot be verified from the audited artifact. In particular, the claim that screenshot processing is exclusively local cannot be validated against the dependency implementation.

This is a supply-chain exposure rather than evidence that the named package is currently malicious. Exploitation would require the upstream package, its publisher account, or the relevant package-distribution path to be compromised or otherwise serve an unsafe release.

Attack Path

  1. An attacker compromises the package publisher, distribution account, release process, or another relevant supply-chain component.
  2. The attacker publishes a malicious or modified release under the expected package name.
  3. An agent follows SKILL.md and runs the unpinned pip install screenshot-stitcher command.
  4. The package manager resolves the attacker-controlled release because no exact version or integrity hash is required.
  5. Package-controlled code executes during installation or when the agent invokes screenshot-stitcher.
  6. The malicious implementation accesses data available to the process, potentially including screenshots, filenames, environment variables, and other files access ...[truncated 765 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a specifically reviewed version, for example with an exact == constraint.
  2. Provide a lockfile or requirements file containing trusted cryptographic hashes, and install with hash verification enabled.
  3. Record the verified package publisher, source repository, release artifact, and expected checksum.
  4. Prefer including or vendoring the reviewed CLI source so its behavior can be audited with the skill.
  5. Install the package in a dedicated virtual environment rather than modifying a shared Python environment.
  6. Run image processing with least privilege, restricting filesystem and network access where practical.
  7. Revalidate the dependency and its integrity metadata before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep