ClawHub
Back to skill

Security audit

PhotoFresco

Security checks for vulnerabilities and agentic risk

Overview

PhotoFresco is a clearly scoped image-editing skill that asks users to install and authorize a local MCP server with folder and permission limits.

Install only the pinned PhotoFresco server or a source checkout you trust, grant the narrowest read/write folders needed, avoid overwrite unless you really want replacement, and remember that previews/exports and optional cloud or paid AI requests may expose image content to external providers.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md
From a source checkout of the package instead of npm (nothing to install; the MCP SDK is bundled), use
`"command": "node"` with `"args": ["/path/to/photofresco/src/bin/photofresco.js", "mcp", "--read", …]`.

Other options: `--overwrite` (exports may replace existing files in `--write` folders; you must
also pass `overwrite: true`), `--tools essentials|all|<group,…>` (which operations are listed as
tools), `--profile <folder>|ephemeral` (browser profile), `--browser <path>` (or the
`PHOTOFRESCO_BROWSER` environment variable). Starting the server and listing tools opens nothing;

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
If no `photofresco_*` tools are available, ask the user to add the server. `--read` folders are
where you may open files; `--write` folders are where you may save exports. Without them you can
still create documents, edit and preview, but cannot touch their files.

If `npx` reports that the `photofresco` package is not found (it is published to npm in
mid-October 2026), the user can install the PhotoFresco plugin from

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs users to run npx -y photofresco without a pinned version, which allows whatever package version is current at execution time to be fetched and run. That creates a supply-chain risk: a compromised new release, typo/confusion package, or unexpected breaking change could execute arbitrary code on the user's machine under the MCP server context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.