Security audit

Image Quality Filter

Security checks for vulnerabilities and agentic risk

Overview

This image-cleaning skill is coherent, but it can delete or move files in bulk and has an unsafe move path that may overwrite images without enough warning.

Review this skill before installing if your image folders contain originals or important datasets. Use the default list action first, test on a copy or small sample, avoid move destinations that may already contain same-named files, and only delete after reviewing the reported images and keeping backups.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/quality_filter.py:204
Finding: Destination File Overwrite During Move Operations
Content: View full analysis
--action move --output `. 5. Both source files resolve to `/photo.jpg`. 6. Depending on platform filesystem semantics, a subsequent `shutil.move` replaces the existing destination. 7. The previously moved or pre-existing destination file is lost. ### Impact Assessment The issue can cause unintended and potentially irreversible loss of image files. Its scope is limited to files writable by the account executing the script and to destination names derived from identified low-quality images. It does not ...[truncated 113 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:57
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly advertises a destructive 'delete' action for low-quality images but does not provide any warning, confirmation step, or guidance about irreversible data loss. In a dataset-cleaning context, users may assume the filter is reliable and accidentally delete valuable originals or misclassified images at scale.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The usage example directly instructs users to run a delete action on a path of images without any cautionary note, dry-run guidance, or confirmation mechanism. Example commands are high-trust copy/paste targets, so presenting destructive behavior this way materially increases the risk of accidental bulk data loss.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script is presented as an image quality detector/filter, but it also supports destructive actions that delete files or move them out of place. In an agent or skill context, that mismatch increases the risk that a user or orchestrator invokes it expecting analysis only, leading to unintended data loss across recursively scanned directories.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The example output states that low-quality images were removed, normalizing destructive behavior without explaining the data impact or possibility of misclassification. While less severe than an executable delete example, it still conditions users to expect silent removal as standard behavior.
Content: No source excerpt is available for this finding.