ClawHub
Back to skill

Security audit

Image Process

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate image-processing skill, but it needs Review because the published package has mismatched install metadata and scanner-reported vulnerable image-processing dependencies.

Review before installing. The skill does not show hidden or malicious behavior, but users should prefer a rebuilt release with regenerated package-lock.json, patched sharp/background-removal/transitive dependencies, and clear overwrite guidance. Until then, run it in a contained directory, avoid untrusted images, and use distinct output filenames.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Known Vulnerable Dependency: tar==7.5.9 — 8 advisory(ies): CVE-2026-59873 (node-tar: Decompression/parse DoS via unlimited input); CVE-2026-59874 (node-tar: Negative tar entry size causes infinite loop in archive replace); CVE-2026-31802 (node-tar Symlink Path Traversal via Drive-Relative Linkpath) +5 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding
The lockfile includes tar 7.5.9 through onnxruntime-node, and the listed advisories include denial-of-service and path traversal issues in archive handling. This is not the skill's primary business logic, but install-time or runtime archive extraction in native dependency tooling increases supply-chain risk, especially for builds or environments that fetch and unpack artifacts automatically.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High
Category
Supply Chain
Confidence
84% confidence
Finding
The lockfile includes lodash 4.17.23, a version associated with prototype pollution and template-related code injection advisories. Whether exploitability is reachable depends on actual code paths, but in an agent skill that may process user-controlled options or structured input, these classes of bugs can become relevant if lodash helpers like path setters/unsetters or template compilation are used indirectly by the application or dependencies.

Known Vulnerable Dependency: sharp==0.32.6 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
88% confidence
Finding
The skill depends on sharp 0.32.6, and sharp handles attacker-supplied image files in this skill context. Image-processing libraries frequently expose native-code parsing attack surface through underlying codecs such as libvips/libheif, so known inherited vulnerabilities are especially concerning here because the core purpose of the skill is to ingest and transform untrusted images.

Known Vulnerable Dependency: sharp==0.32.6 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
98% confidence
Finding
The package depends on sharp 0.32.6, which is flagged with known advisories in native image parsing libraries (libvips/libheif). In an image-processing skill that likely handles untrusted user-supplied images, vulnerable parsers substantially increase risk of crashes, denial of service, or potentially memory-corruption-style exploitation through crafted image files.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The lockfile metadata identifies the package as "image-merge-skill" with a binary named "image-merge", which does not match the declared skill name and purpose of "image-process" for compression, background removal, and upscaling. This mismatch is a supply-chain integrity concern because it can indicate the wrong package was bundled, repurposed code was shipped without review, or the manifest is misrepresenting what will execute.

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill documentation describes operations that write output images to disk but does not warn users that files may be created or overwritten. In an agentic context, missing disclosure about filesystem side effects can lead to accidental data loss or unintended modification of user files, even though the skill appears designed for legitimate image processing.

Known Vulnerable Dependency: zod==3.21.4 — 1 advisory(ies): CVE-2023-4316 (Zod denial of service vulnerability)

Low
Category
Supply Chain
Confidence
77% confidence
Finding
Zod 3.21.4 has a documented denial-of-service issue, typically relevant when validating attacker-controlled deeply nested or pathological inputs. In this skill, Zod is transitive under background-removal tooling, so impact is lower than the native image-parser issues, but it can still contribute to resource exhaustion if exposed to untrusted request payloads.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "",
  "license": "MIT",
  "dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }
}
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }
}
Confidence
40% confidence
Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

No suspicious patterns detected.