ClawHub
Back to skill

Security audit

PicGo Upload

Security checks for vulnerabilities and agentic risk

Overview

The PicGo upload skill is mostly coherent, but its helper script can be pointed at arbitrary HTTP hosts and may send a local auth secret and file paths there.

Review this skill before installing. It is suitable for PicGo-based uploads only if you are comfortable with public links and global PicGo CLI setup. Avoid using --host with anything except localhost or 127.0.0.1, and do not put sensitive files, bearer secrets, or confidential filenames through the GUI helper unless the endpoint is definitely your local PicGo app.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gui-upload.mjs:83
Finding

Bearer Secret and Local Path Disclosure to Arbitrary Hosts over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:66
Finding

Unpinned Global npm Package Installation

Content
View full analysis
Remediation
View remediation
``` 2. Document the expected official package name, publisher, registry, and reviewed version. 3. Prefer a project-local dependency controlled by a lockfile when global installation is not strictly necessary. 4. Require explicit user confirmation before modifying the global npm environment. 5. Verify package provenance and integrity using npm registry metadata, signatures or attestations where available, and a documented checksum or approved lockfile. 6. Periodically review and deliberately update the pinned version rather than automatically selecting the latest release. 7. Continue prohibiting automatic `sudo` use, and clearly explain that elevated installation expands the potential impact of dependency compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
node scripts/gui-upload.mjs /abs/path/to/image.png

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

md
node scripts/gui-upload.mjs /abs/path/to/image.png

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gui-upload.mjs (reported line 111)May include surrounding context.

js
}

// --- Secret resolution ------------------------------------------------------
// Priority: --secret flag > .env next to this script > PICGO_SERVER_SECRET env.

function resolveSecret (flagSecret) {
  if (flagSecret) return flagSecret

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gui-upload.mjs (reported line 123)May include surrounding context.

js
}

// --- Secret resolution ------------------------------------------------------
// Priority: --secret flag > .env next to this script > PICGO_SERVER_SECRET env.

function resolveSecret (flagSecret) {
  if (flagSecret) return flagSecret

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gui-upload.mjs (reported line 222)May include surrounding context.

js
}

// --- Secret resolution ------------------------------------------------------
// Priority: --secret flag > .env next to this script > PICGO_SERVER_SECRET env.

function resolveSecret (flagSecret) {
  if (flagSecret) return flagSecret

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/gui-upload.mjs (reported line 117)May include surrounding context.

js
if (flagSecret) return flagSecret

  const scriptDir = path.dirname(fileURLToPath(import.meta.url))
  const envPath = path.join(scriptDir, '.env')
  if (existsSync(envPath)) {
    try {
      // Node 22 builtin; loads KEY=VALUE pairs into process.env. Zero-dependency.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

npm install picgo -g

text

If the install fails (commonly an `EACCES` permission error), **don't try sudo automatically** — show the user the command to run themselves (e.g. `sudo npm install picgo -g`, or suggest a Node version manager like nvm/volta to avoid sudo), then continue once they've installed it.

### Step 3 — Upload via the CLI (optimistic)

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script claims to talk to a local PicGo GUI server, but exposing a user-controlled --host lets callers direct requests to arbitrary hosts over HTTP. That broadens the skill into a generic network client and can enable SSRF-style access to internal services or accidental exfiltration of local file paths and authentication secrets to a non-local endpoint.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/gui-upload.mjs:120