Security audit

Image Highlight Cropper

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent image-cropping helper, but it includes unsafe runtime dependency installation and an unsafe filename-handling pattern that users should review before installing.

Install only if you are comfortable with a skill that may run local Python on uploaded images. Before use, replace the dependency step with a pinned dependency in an isolated virtual environment, and handle uploaded filenames as validated data rather than inserting them into code.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:131
Finding: Unpinned Dependency Installation Bypasses System Package Protections
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Unsafe Uploaded Filename Interpolation Can Enable Code Injection or Path Traversal
Content: View full analysis
` ``` ```python img = Image.open("/mnt/user-data/uploads/IMAGE_FILENAME") ``` ### Technical Analysis The filename is embedded inside a Python string literal in code intended to be executed through a shell-backed tool. The instructions do not require escaping, validation, canonicalization, or argument-based transfer of the filename. If an uploaded filename containing quotation marks, backslashes, newlines, or Python syntax is substituted literally for `IMAGE_FILENAME`, it may terminate the string literal and inject additional Python statements. Separately, path separators and `..` components could cause the resolved path to escape `/mnt/user-data/uploads` and select another file accessible to the process. Exploitation depends on the surrounding platform preserving an attacker-controlled filename and the agent substituting it literally. The unsafe pattern nevertheless lacks the controls needed to guarantee that generated source code and filesystem paths remain safe. ### Attack Path 1. An attacker uploads an image whose filename contains Python metacharacters or path-traversal components. 2. The agent follows the workflow and substitutes that filename directly into the quoted Python source template. 3. The generated program is passed to `bash_tool` and executed. 4. A quotation mark or newline changes the structure of the Python program, allowing injected statements to run; alternatively, traversal components resolve outside the intended upload directory. 5. The injected code or unintended file access occurs with the permissions and filesystem visibility of th ...[truncated 561 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger text is overly broad, especially phrases like 'any variation' and 'Always use this skill', which can cause the agent to invoke the skill in situations the user did not clearly request. This increases the chance of unintended image processing and file creation, which is a real safety and privacy concern even though it is not overtly malicious.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template summary and follow-up prompt are written in German and presented as the required output format, but the skill does not state that language is user-selectable. This creates a locale policy issue because the skill implicitly enforces a specific language regardless of user preference.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill saves derived image crops to the outputs directory and presents them as downloadable files, but the user-facing description does not disclose that persistence behavior. This can surprise users and create a minor privacy issue because transformed content is stored and exposed as files without prior notice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.