Ecdysales

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:27 AM UTC
• Version: 1.0.2

Overview

This is a local image-editing skill, but it needs review because its scripts can install system packages, scan a default pictures folder, and expose a command-execution bug through advanced options.

Review before installing. Do not run setup.sh --install unless you are comfortable with it changing system packages, set ECDYSALES_MEDIA_DIR to a narrow staging folder if using --latest, and avoid exposing user-controlled advanced flags until numeric validation and option allowlisting are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/make-product.sh:205

Finding

Command Execution Through Unvalidated Bash Arithmetic Expressions

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi } require_uint "sticker stroke width" "$STICKER_STROKE_WIDTH" require_uint "logo size" "$LOGO_SIZE" require_uint "logo opacity" "$LOGO_OPACITY" require_uint "font size" "$FONT_SIZE" require_uint "corner radius" "$CORNER_RADIUS" require_uint "padding" "$PADDING" require_uint "pattern opacity" "$PATTERN_OPACITY" ``` 2. **Enforce explicit bounds after syntax validation.** Recommended constraints include: - Opacity: `0-100`. - Logo size: `1-100`. - Stroke width, padding, corner radius, and font size: conservative positive limits appropriate for expected images. - Width and height ratios: strict decimal values greater than `0` and no greater than `1`. 3. **Validate decimal ratios without constructing executable `bc` programs from raw input.** Use a strict regular expression such as `^(0(\.[0-9]+)?|1(\.0+)?)$`, then pass values through controlled calculation code. 4. **Validate enumerated options.** Restrict positions to: - `top-left` - `top-right` - `bottom-left` - `bottom-right` - `random` 5. **Reject unknown wrapper arguments.** `run.sh` should use an allowlist rather than forwarding every unrecognized option to `make-product.sh`. 6. **Apply the same validation to configuration-derived values.** Configuration checks should verify types, finite numeric values, bounds, color syntax, font names, and allowed positions before constructing command arguments. 7. **Add regression tests** that confirm payloads containing `$()`, backticks, brackets, semicolons, signs, whitespace, newlines, and non-decimal arithmetic syntax are rejected before any arith ...[truncated 46 chars]

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill advertised as simple image processing appears to also perform dependency checks, permission changes, filesystem setup, package installation, and possible sudo-based system modification. That is a major privilege and behavior expansion: a user invoking image editing should not implicitly trigger host changes or package manager activity, which can alter system integrity and create abuse paths.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A skill advertised as simple image processing appears to also perform dependency checks, permission changes, filesystem setup, package installation, and possible sudo-based system modification. That is a major privilege and behavior expansion: a user invoking image editing should not implicitly trigger host changes or package manager activity, which can alter system integrity and create abuse paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script includes host-level package management logic using apt, dnf, pacman, and brew, which gives the skill the ability to alter the local machine beyond its declared function. In an agent or semi-automated environment, this broad capability increases the blast radius from simple image processing to arbitrary system software changes.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The --noconfirm flag is a risky parameter because it disables safeguards intended to ensure the user approves package transactions. Combined with sudo, it enables unattended privileged changes to the host, which is excessive for the skill's minimal image-processing purpose.

Content

Scanner excerpt · scripts/setup.sh (reported line 86)May include surrounding context.

sh

elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3
  elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm imagemagick bc python3
  elif command -v brew &>/dev/null; then
    brew install imagemagick bc python3
  else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · HOWTO.md (reported line 43)May include surrounding context.

md

1. Make sure you have [ImageMagick](https://imagemagick.org/) installed
   - **Mac:** `brew install imagemagick`
   - **Ubuntu/Debian:** `sudo apt install imagemagick`
   - **Windows:** download from imagemagick.org

2. Or just run the setup script:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad and underspecified: 'when an agent sees $price: with an attached image' does not define strict parsing rules, trusted sources, or user-confirmation boundaries. In an agentic context, ambiguous activation can cause the skill to run on unintended messages or adversarially crafted content, leading to unauthorized file processing or unsafe command invocation paths in downstream scripts.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell commands (scripts/run.sh --latest ...) but does not declare any explicit tool scope or permissions boundaries. This weakens reviewability and enforcement, making it easier for the skill to execute broader local actions than users would expect, especially since the referenced script likely performs filesystem operations and possibly environment changes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script exposes autonomous behaviors beyond the declared skill scope: it can auto-select a "latest" image from a user directory and batch-process arbitrary directories and price lists. For an agent-integrated skill advertised as a minimal, fast single-image transformer, this scope expansion increases the chance of unintended access to user files and processing of files the user did not explicitly provide.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Defaulting to scan ~/Pictures/incoming gives the skill ambient access to user-owned files that were not explicitly passed as inputs. In an AI agent context, this is riskier than a normal CLI convenience feature because the agent may trigger file discovery implicitly, causing unexpected data access and processing outside the user's immediate intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The setup script can perform package installation on the host, which exceeds the stated image-processing purpose and changes system state outside the skill's working directory. Even though it is gated behind a --install flag, it still introduces privileged host modification capability that is unnecessary for a narrowly scoped image-editing skill.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Invoking sudo apt-get update elevates the script from a local helper to a privileged host-modifying operation. In the context of a lightweight image-processing skill, requesting or relying on elevated privileges is disproportionate and increases the risk of unintended system-wide changes.

Content

Scanner excerpt · scripts/setup.sh (reported line 81)May include surrounding context.

sh

if [[ "${1:-}" == "--install" ]]; then
  echo "📦 Installing..."
  if command -v apt-get &>/dev/null; then
    sudo apt-get update -qq
    sudo apt-get install -y imagemagick bc python3
  elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Invoking sudo apt-get install performs privileged package installation on the host and can modify system libraries and tooling outside the skill boundary. This is dangerous because the skill's advertised role is image manipulation, not host administration, so users and agents may not expect root-level changes.

Content

Scanner excerpt · scripts/setup.sh (reported line 82)May include surrounding context.

sh

echo "📦 Installing..."
  if command -v apt-get &>/dev/null; then
    sudo apt-get update -qq
    sudo apt-get install -y imagemagick bc python3
  elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3
  elif command -v pacman &>/dev/null; then

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Invoking sudo dnf install similarly grants the script host-level package installation capability with elevated privileges. This broadens the attack surface and violates least privilege for a simple media-processing utility.

Content

Scanner excerpt · scripts/setup.sh (reported line 84)May include surrounding context.

sh

sudo apt-get update -qq
    sudo apt-get install -y imagemagick bc python3
  elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3
  elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm imagemagick bc python3
  elif command -v brew &>/dev/null; then

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

Using --noconfirm suppresses interactive confirmation and enables unattended installation decisions on the host. That makes accidental or policy-violating system changes more likely, especially if the skill is invoked by an automated agent chain or by users who do not realize setup modifies their machine.

Content

Scanner excerpt · scripts/setup.sh (reported line 86)May include surrounding context.

sh

elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3
  elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm imagemagick bc python3
  elif command -v brew &>/dev/null; then
    brew install imagemagick bc python3
  else

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

Invoking sudo pacman -S --noconfirm combines privilege escalation with non-interactive package installation, making host changes both elevated and automatic. In an agent skill context, that is especially risky because it reduces opportunities for the user to review or block unexpected system modifications.

Content

Scanner excerpt · scripts/setup.sh (reported line 86)May include surrounding context.

sh

elif command -v dnf &>/dev/null; then
    sudo dnf install -y ImageMagick bc python3
  elif command -v pacman &>/dev/null; then
    sudo pacman -S --noconfirm imagemagick bc python3
  elif command -v brew &>/dev/null; then
    brew install imagemagick bc python3
  else

Static analysis

No suspicious patterns detected.