Image Highlight Cropper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:34 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent image-cropping helper, but it includes unsafe runtime dependency installation and an unsafe filename-handling pattern that users should review before installing.

Install only if you are comfortable with a skill that may run local Python on uploaded images. Before use, replace the dependency step with a pinned dependency in an isolated virtual environment, and handle uploaded filenames as validated data rather than inserting them into code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:131
• Finding: Unpinned Dependency Installation Bypasses System Package Protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 131 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```bash pip install Pillow --break-system-packages ``` ### Technical Analysis The error-handling instructions recommend installing Pillow directly from the active Python package index without pinning a reviewed version or verifying package hashes. The `--break-system-packages` option explicitly bypasses protections intended to prevent pip from modifying a system-managed Python environment. The package selected and executed during installation therefore depends on mutable external package-index state and local pip configuration. A compromised package index, malicious mirror, dependency-confusion condition, or altered pip configuration could result in attacker-controlled package content being installed. Installation can execute package build hooks or other package-controlled code. Even when the legitimate Pillow package is retrieved, modifying a shared system environment can overwrite or conflict with operating-system-managed dependencies. ### Attack Path 1. Pillow is unavailable when the skill is invoked. 2. The agent follows the documented error-handling instruction. 3. The agent runs `pip install Pillow --break-system-packages`. 4. pip resolves the unpinned dependency through its currently configured package index or mirror. 5. A compromised source, configuration, or package release supplies attacker-controlled installation content. 6. Package installation code executes with the permissions of the agent process and modifies the shared Python environment. ### Impact Assessment Successful exploitation could execute arbitrary code with the permissions of the account running the agent. It could also read or alter files accessible to that account, compromise subsequent Python operations, or destabilize other applications that use the same system-managed environment. The instruction does ...[truncated 180 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--break-system-packages`. - Create and use a dedicated virtual environment for the skill. - Pin Pillow to an exact, reviewed version. - Require cryptographic hashes through a locked requirements file, for example with `pip install --require-hashes -r requirements.txt`. - Download packages only from an approved HTTPS package repository. - Prefer provisioning dependencies during a controlled build process rather than installing them dynamically during skill execution. - Run dependency installation and image processing under a minimally privileged service account. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:39
• Finding: Unsafe Uploaded Filename Interpolation Can Enable Code Injection or Path Traversal<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–55 **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Vulnerable Code The workflow instructs the agent to load a user upload by replacing a filename placeholder in generated Python code: ```markdown Use the `bash_tool` + Python to: 1. Load the image from `/mnt/user-data/uploads/<filename>` ``` ```python img = Image.open("/mnt/user-data/uploads/IMAGE_FILENAME") ``` ### Technical Analysis The filename is embedded inside a Python string literal in code intended to be executed through a shell-backed tool. The instructions do not require escaping, validation, canonicalization, or argument-based transfer of the filename. If an uploaded filename containing quotation marks, backslashes, newlines, or Python syntax is substituted literally for `IMAGE_FILENAME`, it may terminate the string literal and inject additional Python statements. Separately, path separators and `..` components could cause the resolved path to escape `/mnt/user-data/uploads` and select another file accessible to the process. Exploitation depends on the surrounding platform preserving an attacker-controlled filename and the agent substituting it literally. The unsafe pattern nevertheless lacks the controls needed to guarantee that generated source code and filesystem paths remain safe. ### Attack Path 1. An attacker uploads an image whose filename contains Python metacharacters or path-traversal components. 2. The agent follows the workflow and substitutes that filename directly into the quoted Python source template. 3. The generated program is passed to `bash_tool` and executed. 4. A quotation mark or newline changes the structure of the Python program, allowing injected statements to run; alternatively, traversal components resolve outside the intended upload directory. 5. The injected code or unintended file access occurs with the permissions and filesystem visibility of th ...[truncated 561 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never interpolate an uploaded filename into executable Python source. - Pass the path as a command-line argument or another data-only channel and read it through `sys.argv`. - Treat the upload filename as an opaque basename and reject absolute paths, `..` components, path separators, null bytes, and control characters. - Resolve and verify the path before opening it: ```python from pathlib import Path import sys from PIL import Image upload_root = Path("/mnt/user-data/uploads").resolve() candidate = (upload_root / sys.argv[1]).resolve() if upload_root not in candidate.parents: raise ValueError("Upload path escapes the permitted directory") if not candidate.is_file(): raise FileNotFoundError(candidate) img = Image.open(candidate) img.verify() ``` - Prefer a platform-issued file identifier or a trusted enumerated upload path rather than accepting a user-controlled filesystem name. - Run image decoding in a sandbox with minimal filesystem, process, and network permissions. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text is overly broad, especially phrases like 'any variation' and 'Always use this skill', which can cause the agent to invoke the skill in situations the user did not clearly request. This increases the chance of unintended image processing and file creation, which is a real safety and privacy concern even though it is not overtly malicious.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The template summary and follow-up prompt are written in German and presented as the required output format, but the skill does not state that language is user-selectable. This creates a locale policy issue because the skill implicitly enforces a specific language regardless of user preference.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The skill saves derived image crops to the outputs directory and presents them as downloadable files, but the user-facing description does not disclose that persistence behavior. This can surprise users and create a minor privacy issue because transformed content is stored and exposed as files without prior notice.

Static analysis

No suspicious patterns detected.