T09 · Insecure Skill Coding Practices
Error
- Location
vision_ai.py:17- Finding
Untrusted Parent-Directory Module Import Can Execute External Code and Control API Routing
- Content
View full analysis
- Remediation
View remediation
Security audit
03 图像识别
Security checks for vulnerabilities and agentic risk
Overview
This image-recognition skill mostly matches its stated purpose, but it relies on an unbundled parent-directory Python config that can run code and redirect API uploads.
Review this before installing. Use a virtual environment, pin dependencies, and do not use API mode for sensitive images unless you accept third-party upload. The parent-directory llm_config dependency should be bundled or replaced with inert validated config before trusting API keys or uploads, and batch mode should only be run on directories you intentionally selected.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
vision_ai.py:63- Finding
Extension-Only Image Validation Allows Arbitrary File Content to Be Uploaded
- Content
View full analysis
str: """Convert image to base64""" file_info = FileValidator.validate_file(image_path) with open(image_path, "rb") as image_file: return base64.b64encode(image_file.read()).decode('utf-8') ``` ### Technical Analysis `mimetypes.guess_type()` determines the MIME type from the path suffix. It does not inspect magic bytes, decode the image, or establish that the file is a valid image. The subsequent extension comparison does not add independent validation because both values originate from the same filename. A non-image file renamed with an accepted suffix can therefore pass `validate_file()`. In API mode, the accepted file is read in full, Base64-encoded, and included in a request to the selected vision provider. Base64 encoding is a normal and necessary transport mechanism for the documented API functionality; it is not by itself evidence of a covert exfiltration channel. The security issue is that arbitrary bytes can reach that output channel because the preceding validation does not verify image content. Batch mode increases the exposure because it recursively searches a selected directory for accepted extensions and processes matc ...[truncated 1356 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill metadata does not declare any tool scope or allowed-tools restrictions, yet the skill references executable code capabilities via a Python script and the analyzer detected shell-capable behavior. Without explicit permission boundaries, an agent may invoke broader tools than intended, increasing the risk of unintended command execution or misuse of local resources. In this context, the skill handles files, optional network APIs, and local model downloads, which makes missing scope controls more meaningful than in a purely descriptive skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language content of the skill, including the description, usage, troubleshooting, and warnings, is entirely in Chinese. This can amount to a language/locale policy issue because the file does not provide user opt-in, alternative language support, or a justified region-specific constraint.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The top-level documentation states this is a safe tool for image and video recognition. In practice, the validator only permits JPEG/PNG/WEBP/GIF images, and all analysis paths assume still-image inputs with no video decoding or frame extraction. This is an active contradiction between documentation and actual behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In API mode, the tool base64-encodes user-supplied images and sends them to third-party model providers, but it does not provide a clear privacy notice or obtain explicit consent at the point of transfer. This can lead to unintentional disclosure of sensitive local images, especially because the skill is presented as a 'safe' image-recognition tool and users may assume processing is local.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Anthropic path uploads image content to an external API without any explicit user notice or confirmation in the workflow. If users analyze personal, regulated, or confidential images, this can cause unintended data exposure to a third party and create compliance or privacy issues.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The user-facing comments and prompts in this installer are entirely in Chinese, including the installation wizard and interactive questions. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This requirements file contains natural-language comments only in Chinese, such as the header and dependency mode descriptions. That imposes a specific language/locale in the skill's visible text without any indication that users can choose another language, which matches the language-policy concern for natural-language content.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Using a lower-bound specifier like
Pillow>=10.0.0allows installation of any future release, which makes builds non-reproducible and can silently introduce vulnerable or breaking versions through the supply chain. In a vision-processing skill, Pillow is security-relevant because it parses untrusted image files, so dependency drift increases exposure to parser bugs and potential code execution or denial-of-service issues.- Content
text # AI视觉识别技能依赖 # 核心依赖 Pillow>=10.0.0 # API模式（推荐，功能更强大） openai>=1.0.0
Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Pillow has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify whether deployed environments will resolve to a fixed or affected release. This is particularly relevant here because the skill performs image recognition, meaning Pillow is likely to process attacker-controlled image inputs and is therefore on the direct attack path.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
openai>=1.0.0is unpinned, so environments may resolve to different SDK releases over time, reducing reproducibility and potentially pulling in a version with newly introduced security issues or unsafe defaults. The direct security impact is lower than image/model parsing libraries because this is primarily an API client, but supply-chain and behavior drift risks still exist.- Content
text Pillow>=10.0.0 # API模式（推荐，功能更强大） openai>=1.0.0 anthropic>=0.18.0 # 本地模式（可选，无需API但需要下载模型）
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
anthropic>=0.18.0permits uncontrolled upgrades, which can introduce vulnerable SDK versions or changed security behavior without review. Because API SDKs may handle credentials, filesystem interaction, and local tooling, version drift can affect confidentiality and local environment safety.- Content
text # API模式（推荐，功能更强大） openai>=1.0.0 anthropic>=0.18.0 # 本地模式（可选，无需API但需要下载模型） torch>=2.0.0
Unverifiable Dependency: anthropic has 4 known advisory(ies) (CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox); CVE-2026-34450 (The Claude SDK for Python provides access to the Claude API from Python applicat) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 83% confidence
- Finding
The Anthropic SDK has published advisories, and without exact version pinning the installed version cannot be verified as unaffected. The context is somewhat less dangerous than image/model parsers because this is an SDK dependency, but it may still touch credentials, local files, or tool interfaces depending on usage.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
torch>=2.0.0is unpinned, allowing arbitrary newer versions to be installed, which is risky for a local-model skill because PyTorch has a history of issues around deserialization, model loading, and denial of service. In this context, local inference stacks often process downloaded models and complex binary formats, so dependency drift materially increases attack surface.- Content
text anthropic>=0.18.0 # 本地模式（可选，无需API但需要下载模型） torch>=2.0.0 transformers>=4.30.0
Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
PyTorch has several serious advisories, and the lack of version pinning means the security posture of the actual installed dependency is unverifiable. In a local vision model workflow, this is more dangerous because PyTorch may load models, tensors, and serialized artifacts from external sources, placing it directly in a high-risk execution path.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
transformers>=4.30.0allows uncontrolled upgrades of a library that commonly downloads, parses, and executes model-related logic across many formats and integrations. In a vision AI skill using local models, this makes the context more dangerous because compromised or vulnerable releases could affect model loading, prompt/template processing, or temporary-file handling.- Content
text # 本地模式（可选，无需API但需要下载模型） torch>=2.0.0 transformers>=4.30.0
Unverifiable Dependency: transformers has 16 known advisory(ies) (CVE-2023-2800 (transformers has Insecure Temporary File); CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Transformers has multiple known advisories, and since the manifest does not pin a version, there is no assurance that installations avoid affected releases. This is especially relevant in a vision AI skill that may download models or preprocess untrusted artifacts, making the library part of a sensitive attack surface.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文件中的标题、CLI输出及默认提示词均固定为中文，例如默认分析提示和交互文案都未提供其他语言选项。根据规则，强制特定语言而没有用户选择或明确的地域性说明，属于语言/locale策略问题。
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The manifest description presents the skill as a picture-recognition tool supporting local and API modes, which implies analyzing supplied images. However, the implementation adds broader filesystem traversal via batch directory enumeration, recursively discovering files under a directory rather than only analyzing explicitly provided images. This expands behavior beyond the narrowly described single-image recognition role.
- Content
Static analysis
No suspicious patterns detected.