Security audit

Image Handler

Security checks for vulnerabilities and agentic risk

Overview

This image utility skill does what it says, but users should be careful with output paths and batch conversions because it can create or overwrite image files.

Install only if you want a local image-processing helper. Before running conversion or batch commands, choose explicit output paths, check whether files already exist, and avoid using untrusted filenames or unusual quality arguments until the scripts are hardened.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/convert_image.sh:16
Finding: Unvalidated Quality Argument Allows SIPS Option Injection
Content: View full analysis
/dev/null 2>&1 ``` ### Technical Analysis The optional `QUALITY` argument is accepted without validating that it is an integer in an appropriate range. It is embedded into the `FORMAT_OPTS` string and subsequently expanded without quotation marks. Bash performs word splitting on the unquoted `$FORMAT_OPTS` expansion. Consequently, a value containing spaces can introduce additional command-line arguments to `sips`. This is an argument or option injection weakness. This is not direct shell-command injection because shell metacharacters contained in the variable are not parsed again as shell syntax during ordinary parameter expansion. Nevertheless, injected arguments may modify how `sips` processes files or options. ### Attack Path 1. An attacker or untrusted caller supplies a crafted third argument containing whitespace and additional `sips` options. 2. The script stores the entire value in `QUALITY` without numeric validation. 3. `FORMAT_OPTS` incorporates the attacker-controlled value. 4. The unquoted `$FORMAT_OPTS` expansion is split into multiple arguments. 5. `sips` interprets the additional words as command-line options or option values. 6. Depending on supported `sips` arguments and filesystem permissions, processing can be altered, unintended files may be accessed or overwritten, or the conversion can be forced to fail. ### Impact Assessment Exploitation is limited to the permissions of the user running the script and requires control over the quality argument. It does not independently provide privilege escalation or arbitrary shell-command execution. The practical scope in ...[truncated 207 chars]
Remediation: View remediation
100 )); then echo "Error: Quality must be an integer between 0 and 100" >&2 exit 1 fi sips -s format "$FORMAT" \ -s formatOptions "$QUALITY" \ "$INPUT" --out "$OUTPUT" >/dev/null 2>&1 ``` If optional arguments become more complex, construct them with an array: ```bash SIPS_ARGS=(-s format "$FORMAT") if [[ "$FORMAT" == "jpeg" ]]; then SIPS_ARGS+=(-s formatOptions "$QUALITY") fi sips "${SIPS_ARGS[@]}" "$INPUT" --out "$OUTPUT" ``` ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/image_info.sh:23
Finding: Option-Like Image Paths Are Passed to Utilities Without Defensive Normalization
Content: View full analysis
&1 | tail +2 || echo "Could not read image properties" echo "" # For SVG, show first few lines if [[ "$EXT" == "svg" ]]; then echo "--- SVG Content (first 20 lines) ---" head -20 "$IMAGE" fi ``` ### Technical Analysis The image path is quoted, which prevents shell word splitting and wildcard expansion, but quoting does not stop a command from interpreting a filename beginning with `-` as an option. The script passes the caller-controlled path directly to `ls`, `sips`, and `head` without end-of-options delimiters or path normalization. Where the invoked utility continues parsing options at that position, an existing option-like filename can alter utility behavior. The initial `[[ -f "$IMAGE" ]]` check limits exploitation to names resolving to existing files, but it does not ensure that downstream utilities interpret the same string strictly as a filename. ### Attack Path 1. An attacker creates or supplies an image with an option-like filename, such as a relative filename beginning with `-`. 2. A user invokes `image_info.sh` using that bare filename. 3. The script confirms that the path resolves to a file. 4. The path is passed to `ls`, `sips`, or `head` without an end-of-options delimiter or normalized path prefix. 5. A utility may interpret the filename as an option rather than as the intended image operand. 6. The command may produce unintended output, process an unintended operand, or fail. ### Impact Assessment The weakness operates only with the privileges of the invoking user and does not provide direct shell execution or privilege escalation. Potential impact incl ...[truncated 261 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/convert_image.sh:50
Finding: Conversion Paths Are Not Consistently Protected Against Option Injection
Content: View full analysis
$OUTPUT (via ffmpeg)" exit 0 ;; *) echo "Error: Unsupported output format: $OUT_EXT" >&2 exit 1 ;; esac sips -s format "$FORMAT" $FORMAT_OPTS "$INPUT" --out "$OUTPUT" >/dev/null 2>&1 echo "Converted: $INPUT -> $OUTPUT" ls -lh "$OUTPUT" | awk '{print "Output size:", $5}' ``` ### Technical Analysis The caller controls both `INPUT` and `OUTPUT`. Although these variables are quoted, option-like paths are passed to `ffmpeg`, `sips`, and `ls` without consistent end-of-options protection or prior normalization. The placement of the path affects exploitability. For example, an `ffmpeg` output path beginning with `-` may be interpreted as another option, while `sips` or `ls` may similarly parse option-like operands according to their command-line rules. This issue is distinct from shell-command injection: shell syntax inside the path is not re-evaluated. The risk is that the invoked program interprets the supplied string as one or more of its own options. ### Attack Path 1. An attacker supplies an existing input file or selected output path whose textual representation begins with `-`. 2. The script validates only that the input resolves to a regular file and that the output extension is supported. 3. The path is passed directly to `ffmpeg`, `sips`, or `ls`. 4. The target utility may parse the path as an option instead of a file operand. 5. Supported utility options may alter processing, target unintended local files, or terminate the conversion. ### Impact Assessment Any effect remains constrained by the permissions of the invoking ...[truncated 319 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger text is broad enough to activate on many ordinary mentions of image files or image-processing requests, which can cause the agent to invoke this skill when the user did not clearly intend file manipulation. In this skill, unintended invocation is more dangerous because the documented actions include conversion, resizing, metadata stripping, and batch processing, all of which can modify files or drive follow-on shell commands.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation presents commands and helper scripts that write output files and may process multiple files, but it does not clearly warn about overwriting risks, output locations, or the scope of batch operations. In practice, a user or agent could run these examples against the wrong path or directory and unintentionally alter, replace, or mass-generate files, especially with shell loops and directory-wide scripts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.