image-edit

• Outcome: Pass
• Latest audit: Sep 20, 2026 · 3:47 AM UTC
• Version: 1.1.2

Overview

This skill is a disclosed image-editing workflow with user approval before paid API use, but users should review the external dependency and unpinned install commands.

Before installing, confirm you trust Ofox with the images you choose to edit and with API-key billing. If ofox-image-core is missing, review the npx recovery command yourself before running it, and prefer a trusted/version-pinned install path where available.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Ae1

High

• Category: analysis-evasion

Content

above. This skill packages only its `SKILL.md` and `CHANGELOG.md`, so nothing

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The changelog includes an unpinned `npx skills add ofoxai/skills --skill ofox-image-core` recovery command. Even though the text explicitly says to relay the command to the user rather than run it automatically, invoking `npx` without a pinned package version can fetch whatever package version is current at execution time, creating a supply-chain risk if the package is compromised or behavior changes unexpectedly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence
• Finding: This line references `npx ofox-skills` without a pinned version. Although the changelog is describing behavior rather than instructing the agent to execute it, unpinned `npx` usage still normalizes fetching and running mutable third-party code, which can expose users to supply-chain compromise or unexpected installer behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence
• Finding: The changelog again names `npx ofox-skills` as a distribution route without version pinning. In this skill context, recovery/install guidance is especially sensitive because users or agents may copy commands directly from documentation, so an unpinned package reference can become an entry point for unintended code execution from the package registry.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: image-edit
description: Requires OFOX_API_KEY — create one at https://app.ofox.ai. Change one thing in an image you already have and leave the rest of the picture alone — swap the background, recolour a part, remove or add an object, clean up a photo — from a local jpeg/png/webp file. Delegates to ofox-image-core's `edit` subcommand (POST /v1/images/edits, one synchronous request), prices the job with --dry-run before spending, and reports the real token cost including the uploaded picture, which is billed. Use when a user hands over an image and asks for a change to it, e.g. "change the background of this photo to a beach and keep the person unchanged", "make this button green", "remove the car in the background", or "put this product on a plain white background". Do not use to draw a new image from a text description with no input picture (that is ofox-image-core's `generate`), to produce a set of several images to choose between (see product-image), or to turn a photo into video (see seedance-product-video or seedance-ad-creative). Editing the content of an existing video — "change the background of my clip, keep the product" — has no route here and none in the video API either (measured; the mode field an edit would use is accepted and silently ignored, so nothing errors); this skill edits a single still, and routing such a request to a video skill generates brand-new footage instead of changing theirs.
license: MIT
version: "1.1.2"
homepage: https://github.com/ofoxai/skills/tree/main/skills/image-edit

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Static analysis

No suspicious patterns detected.