Security audit

PicGo Upload

Security checks across malware telemetry and agentic risk

Overview

This skill is mostly a coherent PicGo upload helper, but it can publish local files to public hosts and contains an under-documented option that can send local paths and secrets to arbitrary HTTP hosts.

Install only if you want an agent to upload selected local files to publicly accessible image/file hosts. Be careful with confidential screenshots, documents, archives, PicGo tokens, and GUI server secrets; avoid using any non-local --host value unless you fully trust that endpoint.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script accepts a user-supplied --host and then sends file paths and optionally a bearer secret to that host over plain HTTP. This breaks the documented trust boundary of a local-only PicGo GUI helper and enables SSRF-style behavior, local file path disclosure, and credential leakage to arbitrary endpoints if an agent or user passes an attacker-controlled host.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The header comments describe the script as talking to a local PicGo desktop server, but the implementation supports arbitrary hosts. That mismatch is security-relevant because reviewers, users, or higher-level agents may trust it as localhost-only while it can actually transmit sensitive data to remote systems.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill description repeatedly frames itself as the default or 'FIRST' choice for turning local files into links, including broad documentation and image-insertion scenarios. That can cause the agent to invoke this skill even when the user only wants to embed or reference an image in a document, resulting in unintended publication of local content to a public host.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The 'When to use' section treats requests to add an image to documentation or markdown as sufficient to trigger upload behavior, even without explicit hosting intent. In context, this is risky because the skill uploads files to publicly accessible hosts, so a normal editing request could be misinterpreted as consent to publish screenshots or documents.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/gui-upload.mjs:120