OraHub Skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate OraHub photo-editing skill, but it relies on installing and running an unpinned global CLI and uses shell-style command templates with user-provided paths.

Review before installing. Only approve the OraHub CLI install if you trust the npm package and publisher, prefer a pinned/audited version where possible, and avoid passing suspicious filenames, URLs, or output paths containing shell metacharacters. Run it with the least filesystem access needed for the images you want edited.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:131

Finding

Unpinned Third-Party Executable Installation

Content

View full analysis

Remediation

View remediation

``` 2. Pin skill installation to an immutable Git commit or signed release rather than a mutable repository default branch. 3. Publish and verify cryptographic integrity metadata or signatures for release artifacts. 4. Maintain and review a lockfile for all runtime and transitive dependencies. 5. Prefer a project-local, sandboxed installation over a global installation where platform constraints permit it. 6. Review and restrict npm lifecycle scripts. Use `--ignore-scripts` when scripts are not required and functionality has been verified without them. 7. Verify the expected npm registry, package publisher, package name, and resolved version before installation. 8. Run the CLI with the minimum filesystem and network permissions required for the image-editing task. 9. Document a tested version compatibility range and require additional approval before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: photo-color-match/SKILL.md:158

Finding

Potential Shell Command Injection Through User-Controlled Paths and URLs

Content

View full analysis

" \ --color-ref "" \ --output "" \ --json ``` `photo-passersby-removal/SKILL.md:132-136`: ```bash orahub photo-passersby-removal \ --input "" \ --output "" \ --json ``` `photo-remove-background/SKILL.md:133-137`: ```bash orahub photo-remove-background \ --input "" \ --output "" \ --json ``` `photo-background-replace/SKILL.md:157-162`: ```bash orahub photo-background-replace \ --input "" \ --background-ref-url "" \ --output "" \ --json ``` ### Technical Analysis The documented command templates interpolate user-controlled local paths, URLs, and output paths into shell-form commands. The surrounding double quotes do not make arbitrary data safe for shell interpretation. In common POSIX shells, command substitutions such as `$(...)` and backticks are still evaluated inside double quotes. An embedded quote can also terminate the intended argument and introduce shell operators. The skill requires paths to be readable and URLs to be public, but those checks do not establish that a value is safe to embed in a shell command. The instructions also do not require the agent to invoke the CLI through a no-shell process API with a separate argument array. This issue is exploitable when the executing agent implements the Markdown template by constructing a command string and passing it to a shell. It is not exploitable if ...[truncated 1617 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- remove passersby / remove tourists / remove background people -> `photo-passersby-removal/SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

- remove passersby / remove tourists / remove background people -> `photo-passersby-removal/SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

- remove passersby / remove tourists / remove background people -> `photo-passersby-removal/SKILL.md`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

- remove passersby / remove tourists / remove background people -> `photo-passersby-removal/SKILL.md`

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

- `photo-color-match/SKILL.md` owns its own input collection, role clarification, batch rules, URL validation, command execution, and delivery
- `photo-passersby-removal/SKILL.md` owns its own input collection, batch rules, URL validation, command execution, and delivery
- `photo-remove-background/SKILL.md` owns its own input collection, PNG output rules, batch rules, URL validation, command execution, and delivery
- `photo-background-replace/SKILL.md` owns its own input collection, two-image role clarification, URL validation, command execution, and delivery

Do not merge the leaf workflows into a new custom command at the router level.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

Claude Code

bash

npx skills add https://github.com/Orahub-ora/orahub-skills
# Installed to: ~/.claude/skills/orahub-skills/

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute npx skills add ... without pinning the skills package to a specific version. Because npx resolves and runs the latest matching package, a compromised or malicious upstream release could result in unintended code execution during installation. In this context, the skill is specifically teaching installation steps, so the risk is more relevant because users are likely to copy-paste the command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This is the same issue repeated for another platform: npx skills add ... invokes an unpinned package from the registry at execution time. If the upstream package is hijacked or a breaking/malicious version is published, users following the README could execute attacker-controlled code. The repository context increases practical exposure because these are explicit setup instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description includes phrases like "same vibe" and "make this photo look like the reference," which are relatively broad and can occur in ordinary image-editing requests without clearly indicating the intended workflow. Although the file later adds clarification guidance, the top-level trigger list itself lacks explicit constraints or exclusion examples to narrow activation scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description lists broad triggers such as "change background" and "swap background," plus "and similar requests," without narrowing context or providing exclusion conditions. In a markdown/manifest file, this can cause unintended invocation for ordinary conversation or unrelated editing contexts because the activation scope is not explicitly bounded.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill says to use it for requests such as "replace background," "change background," and "swap background," which are generic phrases that can occur in everyday or unrelated editing requests. The section provides examples but no explicit non-examples or constraints distinguishing when this skill should not activate.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises a very broad set of natural-language triggers such as 'same vibe' and 'same color mood', which can match ordinary conversation or requests that were not intended to invoke this workflow. In an agentic environment, over-broad routing can cause the wrong skill to activate, leading to unintended command execution, processing of attachments/URLs, or bypass of a more appropriate skill's stricter validation flow.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description lists several specific triggers but then extends them with "and similar requests," which leaves activation boundaries undefined. This can cause unintended invocation for ordinary photo-editing requests that resemble the examples without clearly being in scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says the skill should trigger for phrases like "cutout," "cut out image," and "similar requests," which broadens activation beyond a tightly scoped list. Terms such as "cut out" are common everyday phrasing and the catch-all "similar requests" does not define clear boundaries or exclusions, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.