ClawHub
Back to skill

Security audit

VTL Image Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill locally analyzes user-provided or generated images and writes metrics or prompt suggestions, with no hidden credential access, persistence, exfiltration, or destructive behavior found.

Install only if you are comfortable letting the skill process images or image folders you point it at and create or overwrite metrics.jsonl or prompts.json outputs. For stronger hygiene, pin the Python dependencies before production use and review any custom operators.yaml changes because trigger expressions are evaluated by the regen script.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:13-17
Vulnerability Type: Supply-chain risk from mutable dependency resolution
Risk Level: Medium

Vulnerable Code

yaml
install:
  - id: pip
    kind: pip
    packages: ["numpy", "opencv-python-headless", "scikit-image", "scipy", "pyyaml"]

Technical Analysis

The skill declares five Python packages without exact versions or cryptographic hashes. Consequently, installation resolves whatever compatible releases the package registry serves at that time rather than the versions reviewed and tested by the project.

This creates a supply-chain exposure: a compromised upstream release, compromised package publisher account, malicious registry mirror, or dependency-resolution manipulation could cause installation of code that is not part of this audited artifact. Python packages may execute code during installation and are subsequently imported by the skill scripts.

No evidence indicates that the currently named packages are malicious. The finding concerns the absence of dependency integrity controls.

Attack Path

  1. An attacker compromises an upstream package release, publisher account, configured package index, or dependency in the transitive dependency graph.
  2. A user installs the skill using the declared pip installation configuration.
  3. Pip resolves the mutable, unpinned dependency to the attacker-controlled release.
  4. Malicious code executes during package installation or when vtl_probe.py or vtl_regen.py imports the affected package.
  5. The payload operates with the privileges and accessible resources of the user or service running the installation or skill.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installer or skill runtime. The accessible scope may include the user's files, images supplied for analysis, process environment, credentials available to that account, and network resources reachable from ...[truncated 147 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin every direct dependency to an exact, reviewed version.
  2. Generate a lock file that also fixes all transitive dependency versions.
  3. Require cryptographic hashes during installation, for example through a hash-locked requirements file and pip's --require-hashes option.
  4. Configure installation to use a trusted package index and reject unexpected fallback indexes.
  5. Regularly scan locked dependencies for known vulnerabilities and update them through a controlled review process.
  6. Test the complete locked dependency set before publishing a new skill version.
  7. Where supported by the skill distribution mechanism, replace the inline mutable package list with a reference to the reviewed lock or requirements file.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

Dangerous chain: eval() wrapping compile

Critical
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

A dangerous execution chain combines code execution (exec/eval) with a dynamic source (network, encoded data, dynamic import), creating a high-confidence attack vector.

Content

Scanner excerpt · scripts/vtl_regen.py (reported line 39)May include surrounding context.

python
"abs": abs, "min": min, "max": max,
        **{k: v for k, v in ctx.items() if isinstance(v, (int, float))}
    }
    return bool(eval(compile(tree, "<trigger>", "eval"), {"__builtins__": {}}, allowed_names))

def load_latest_metrics(metrics_path: Path) -> dict:
    # Accept JSON (single object) or JSONL (take last non-empty line)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

A description-behavior mismatch is dangerous because operators and users rely on the manifest to understand what the skill will do, what outputs to expect, and when it should run. If the implementation omits promised remediation logic or performs extra actions like batch folder processing, the skill may be invoked in inappropriate contexts, touch more files than expected, or produce misleading security and quality outcomes.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
85% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · operators.yaml (reported line 4)May include surrounding context.

yaml
version: 1
name: vtl-operators
notes:
  - "Operators are prompt patches. They do not judge aesthetics."
  - "Triggers are evaluated deterministically against metric values."
  - "The AI does not modify or invent operators. Edit this file to change behavior."
  - "Patch language appends geometric constraints — it does not rewrite the subject."

eval() call detected

High
Category
Dangerous Code Execution
Confidence
85% confidence
Finding

Direct eval() call evaluates arbitrary expressions. This can be exploited to execute malicious code or exfiltrate data.

Content

Scanner excerpt · scripts/vtl_regen.py (reported line 39)May include surrounding context.

python
"abs": abs, "min": min, "max": max,
        **{k: v for k, v in ctx.items() if isinstance(v, (int, float))}
    }
    return bool(eval(compile(tree, "<trigger>", "eval"), {"__builtins__": {}}, allowed_names))

def load_latest_metrics(metrics_path: Path) -> dict:
    # Accept JSON (single object) or JSONL (take last non-empty line)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/vtl_regen.py (reported line 155)May include surrounding context.

python
ap.add_argument("--prompt", required=True, help="Original semantic prompt. This tool appends geometric constraints; it does not rewrite the subject.")
    ap.add_argument("--metrics", required=True, help="Path to metrics JSON or JSONL (typically output of vtl_probe.py).")
    ap.add_argument("--operators", default=str(Path(__file__).resolve().parents[1] / "operators.yaml"), help="Path to operators.yaml")
    ap.add_argument("--out", default="prompts.json", help="Output prompts JSON file.")
    ap.add_argument("--max-alts", type=int, default=2, help="Max alternative operator variants to emit (in addition to selected).")
    args = ap.parse_args()

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises very broad natural-language triggers such as 'Analyze this image's composition' and 'Why does this generated image look generic?'. In agent environments, generic phrases can cause the skill to activate during ordinary conversation or on untrusted content, increasing the chance of unintended execution and data flow into the skill.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to read an input image, read metrics/config files, and write outputs like prompts.json, but it declares no explicit tool scope or permissions. In agent environments, missing scope boundaries can let the skill access or modify files more broadly than intended, increasing the blast radius if the skill is mis-invoked or combined with prompt/path manipulation elsewhere.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill tells the agent to invoke it proactively after image generation or when users ask for better composition, which is broad enough to trigger on many normal workflows without explicit consent. Over-broad auto-invocation can cause unnecessary file access, unexpected prompt transformation, and chained execution of local scripts in contexts where the user only wanted generation, not analysis or post-processing.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

compile() call detected

Medium
Category
Dangerous Code Execution
Confidence
65% confidence
Finding

compile() creates code objects from strings. When combined with exec()/eval(), it enables obfuscated code execution.

Content

Scanner excerpt · scripts/vtl_regen.py (reported line 39)May include surrounding context.

python
"abs": abs, "min": min, "max": max,
        **{k: v for k, v in ctx.items() if isinstance(v, (int, float))}
    }
    return bool(eval(compile(tree, "<trigger>", "eval"), {"__builtins__": {}}, allowed_names))

def load_latest_metrics(metrics_path: Path) -> dict:
    # Accept JSON (single object) or JSONL (take last non-empty line)

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This manifest file uses trigger conditions like metric thresholds, but it does not explain when these operators should or should not be considered outside those raw expressions. Without explicit scope boundaries or exclusion conditions, unintended activation is more likely if the same metrics are computed in broader contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The trigger definition relies on a single threshold expression and does not document limits on when the operator should be suppressed. For manifest files, missing specificity on trigger scope or constraints can lead to ambiguous invocation behavior even if evaluation is deterministic.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/vtl_regen.py:39