ClawHub
Back to skill

Security audit

hal-image

Security checks for vulnerabilities and agentic risk

Overview

This image-handling skill is coherent and disclosed, but users should be aware that its compression recipes may remove image metadata.

Install is reasonable for routine image optimization and conversion. Keep untouched originals when images are evidentiary, signed, forensic, or metadata-sensitive, and avoid metadata-stripping options unless that is intended.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
79% confidence
Finding
The activation guidance is overly broad: it instructs use not only when the user requests image processing, but also before attaching any image to a message or upload. In an agent setting, such broad auto-invocation can cause unintended processing of sensitive user images, metadata stripping, format conversion, or silent modification without explicit need or consent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The unconditional 'Always right before attaching any image to a message or upload — compress it first' instruction is risky because it normalizes automatic modification of all images, including evidence, screenshots, or files where metadata preservation matters. Combined with the skill's 'fail open' posture, this broad rule can lead to unreviewed transformations and inconsistent handling of user content.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The recipe includes `-strip` and guidance to drop EXIF/non-essential metadata, but does not clearly warn that this irreversibly removes information such as orientation history, timestamps, geotags, camera details, and embedded profiles. In this skill’s context, images are routinely processed before delivery, so an operator may follow the recipe by default and unintentionally destroy metadata the user expected to preserve.

Static analysis

No suspicious patterns detected.