Image Handler

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:12 AM UTC
• Version: 1.0.0

Overview

This image utility skill does what it says, but users should be careful with output paths and batch conversions because it can create or overwrite image files.

Install only if you want a local image-processing helper. Before running conversion or batch commands, choose explicit output paths, check whether files already exist, and avoid using untrusted filenames or unusual quality arguments until the scripts are hardened.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/convert_image.sh:16
• Finding: Unvalidated Quality Argument Allows SIPS Option Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/convert_image.sh`, lines 16, 30, and 60 **Vulnerability Type**: Unvalidated argument expansion and option injection **Risk Level**: Low ### Vulnerable Code ```bash QUALITY="${3:-85}" ``` ```bash FORMAT_OPTS="-s formatOptions $QUALITY" ``` ```bash sips -s format "$FORMAT" $FORMAT_OPTS "$INPUT" --out "$OUTPUT" >/dev/null 2>&1 ``` ### Technical Analysis The optional `QUALITY` argument is accepted without validating that it is an integer in an appropriate range. It is embedded into the `FORMAT_OPTS` string and subsequently expanded without quotation marks. Bash performs word splitting on the unquoted `$FORMAT_OPTS` expansion. Consequently, a value containing spaces can introduce additional command-line arguments to `sips`. This is an argument or option injection weakness. This is not direct shell-command injection because shell metacharacters contained in the variable are not parsed again as shell syntax during ordinary parameter expansion. Nevertheless, injected arguments may modify how `sips` processes files or options. ### Attack Path 1. An attacker or untrusted caller supplies a crafted third argument containing whitespace and additional `sips` options. 2. The script stores the entire value in `QUALITY` without numeric validation. 3. `FORMAT_OPTS` incorporates the attacker-controlled value. 4. The unquoted `$FORMAT_OPTS` expansion is split into multiple arguments. 5. `sips` interprets the additional words as command-line options or option values. 6. Depending on supported `sips` arguments and filesystem permissions, processing can be altered, unintended files may be accessed or overwritten, or the conversion can be forced to fail. ### Impact Assessment Exploitation is limited to the permissions of the user running the script and requires control over the quality argument. It does not independently provide privilege escalation or arbitrary shell-command execution. The practical scope in ...[truncated 207 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Validate the quality argument before invoking `sips`. Accept only an integer in an explicitly supported range, such as 0 through 100. Avoid constructing command arguments in a scalar string. Pass every argument separately or use a Bash array: ```bash QUALITY="${3:-85}" if [[ ! "$QUALITY" =~ ^[0-9]+$ ]] || (( QUALITY < 0 || QUALITY > 100 )); then echo "Error: Quality must be an integer between 0 and 100" >&2 exit 1 fi sips -s format "$FORMAT" \ -s formatOptions "$QUALITY" \ "$INPUT" --out "$OUTPUT" >/dev/null 2>&1 ``` If optional arguments become more complex, construct them with an array: ```bash SIPS_ARGS=(-s format "$FORMAT") if [[ "$FORMAT" == "jpeg" ]]; then SIPS_ARGS+=(-s formatOptions "$QUALITY") fi sips "${SIPS_ARGS[@]}" "$INPUT" --out "$OUTPUT" ``` ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/image_info.sh:23
• Finding: Option-Like Image Paths Are Passed to Utilities Without Defensive Normalization<![CDATA[ ## Vulnerability Details **File Location**: `scripts/image_info.sh`, lines 23–35 **Vulnerability Type**: Command-line option injection through crafted filenames **Risk Level**: Low ### Vulnerable Code ```bash # Basic file info echo "--- File ---" ls -lh "$IMAGE" | awk '{print "Size:", $5}' echo "" # Image properties echo "--- Properties ---" sips -g all "$IMAGE" 2>&1 | tail +2 || echo "Could not read image properties" echo "" # For SVG, show first few lines if [[ "$EXT" == "svg" ]]; then echo "--- SVG Content (first 20 lines) ---" head -20 "$IMAGE" fi ``` ### Technical Analysis The image path is quoted, which prevents shell word splitting and wildcard expansion, but quoting does not stop a command from interpreting a filename beginning with `-` as an option. The script passes the caller-controlled path directly to `ls`, `sips`, and `head` without end-of-options delimiters or path normalization. Where the invoked utility continues parsing options at that position, an existing option-like filename can alter utility behavior. The initial `[[ -f "$IMAGE" ]]` check limits exploitation to names resolving to existing files, but it does not ensure that downstream utilities interpret the same string strictly as a filename. ### Attack Path 1. An attacker creates or supplies an image with an option-like filename, such as a relative filename beginning with `-`. 2. A user invokes `image_info.sh` using that bare filename. 3. The script confirms that the path resolves to a file. 4. The path is passed to `ls`, `sips`, or `head` without an end-of-options delimiter or normalized path prefix. 5. A utility may interpret the filename as an option rather than as the intended image operand. 6. The command may produce unintended output, process an unintended operand, or fail. ### Impact Assessment The weakness operates only with the privileges of the invoking user and does not provide direct shell execution or privilege escalation. Potential impact incl ...[truncated 261 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use an end-of-options delimiter for utilities that support it: ```bash ls -lh -- "$IMAGE" | awk '{print "Size:", $5}' head -20 -- "$IMAGE" ``` For utilities whose end-of-options behavior is unavailable or uncertain, normalize relative paths before invocation so they do not begin with `-`: ```bash case "$IMAGE" in /*) ;; *) IMAGE="./$IMAGE" ;; esac ``` Prefer canonical path resolution where portability permits, and reject ambiguous option-like paths if safe normalization cannot be guaranteed. Test the hardened implementation against filenames containing leading hyphens, whitespace, wildcard characters, and newlines. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/convert_image.sh:50
• Finding: Conversion Paths Are Not Consistently Protected Against Option Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/convert_image.sh`, lines 50–63 **Vulnerability Type**: Command-line option injection through crafted input or output paths **Risk Level**: Low ### Vulnerable Code ```bash webp|heic|heif) # sips doesn't support WebP/HEIC output, use ffmpeg ffmpeg -y -i "$INPUT" "$OUTPUT" echo "Converted: $INPUT -> $OUTPUT (via ffmpeg)" exit 0 ;; *) echo "Error: Unsupported output format: $OUT_EXT" >&2 exit 1 ;; esac sips -s format "$FORMAT" $FORMAT_OPTS "$INPUT" --out "$OUTPUT" >/dev/null 2>&1 echo "Converted: $INPUT -> $OUTPUT" ls -lh "$OUTPUT" | awk '{print "Output size:", $5}' ``` ### Technical Analysis The caller controls both `INPUT` and `OUTPUT`. Although these variables are quoted, option-like paths are passed to `ffmpeg`, `sips`, and `ls` without consistent end-of-options protection or prior normalization. The placement of the path affects exploitability. For example, an `ffmpeg` output path beginning with `-` may be interpreted as another option, while `sips` or `ls` may similarly parse option-like operands according to their command-line rules. This issue is distinct from shell-command injection: shell syntax inside the path is not re-evaluated. The risk is that the invoked program interprets the supplied string as one or more of its own options. ### Attack Path 1. An attacker supplies an existing input file or selected output path whose textual representation begins with `-`. 2. The script validates only that the input resolves to a regular file and that the output extension is supported. 3. The path is passed directly to `ffmpeg`, `sips`, or `ls`. 4. The target utility may parse the path as an option instead of a file operand. 5. Supported utility options may alter processing, target unintended local files, or terminate the conversion. ### Impact Assessment Any effect remains constrained by the permissions of the invoking ...[truncated 319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Normalize all caller-supplied paths before passing them to external utilities. Convert relative paths to absolute paths or prefix them with `./` so they cannot begin with an option marker. Use end-of-options delimiters wherever the relevant utility supports them: ```bash ls -lh -- "$OUTPUT" | awk '{print "Output size:", $5}' ``` For `ffmpeg`, use normalized paths and explicit file operands. For example: ```bash normalize_path() { case "$1" in /*) printf '%s\n' "$1" ;; *) printf './%s\n' "$1" ;; esac } INPUT="$(normalize_path "$INPUT")" OUTPUT="$(normalize_path "$OUTPUT")" ffmpeg -y -i "$INPUT" "$OUTPUT" ``` Apply equivalent normalization before the `sips` invocation. Also combine this hardening with numeric quality validation and array-based argument construction so that every external command receives a fixed, unambiguous argument boundary. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger text is broad enough to activate on many ordinary mentions of image files or image-processing requests, which can cause the agent to invoke this skill when the user did not clearly intend file manipulation. In this skill, unintended invocation is more dangerous because the documented actions include conversion, resizing, metadata stripping, and batch processing, all of which can modify files or drive follow-on shell commands.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation presents commands and helper scripts that write output files and may process multiple files, but it does not clearly warn about overwriting risks, output locations, or the scope of batch operations. In practice, a user or agent could run these examples against the wrong path or directory and unintentionally alter, replace, or mass-generate files, especially with shell loops and directory-wide scripts.

Static analysis

No suspicious patterns detected.