ClawHub
Back to skill

Security audit

Image Process

Security checks for vulnerabilities and agentic risk

Overview

This looks like a legitimate image-processing skill, but it needs Review because the published package has mismatched install metadata and scanner-reported vulnerable image-processing dependencies.

Review before installing. The skill does not show hidden or malicious behavior, but users should prefer a rebuilt release with regenerated package-lock.json, patched sharp/background-removal/transitive dependencies, and clear overwrite guidance. Until then, run it in a contained directory, avoid untrusted images, and use distinct output filenames.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Known Vulnerable Dependency: tar==7.5.9 — 8 advisory(ies): CVE-2026-59873 (node-tar: Decompression/parse DoS via unlimited input); CVE-2026-59874 (node-tar: Negative tar entry size causes infinite loop in archive replace); CVE-2026-31802 (node-tar Symlink Path Traversal via Drive-Relative Linkpath) +5 more

Critical
Category
Supply Chain
Confidence
91% confidence
Finding

The lockfile includes tar 7.5.9 through onnxruntime-node, and the listed advisories include denial-of-service and path traversal issues in archive handling. This is not the skill's primary business logic, but install-time or runtime archive extraction in native dependency tooling increases supply-chain risk, especially for builds or environments that fetch and unpack artifacts automatically.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High
Category
Supply Chain
Confidence
84% confidence
Finding

The lockfile includes lodash 4.17.23, a version associated with prototype pollution and template-related code injection advisories. Whether exploitability is reachable depends on actual code paths, but in an agent skill that may process user-controlled options or structured input, these classes of bugs can become relevant if lodash helpers like path setters/unsetters or template compilation are used indirectly by the application or dependencies.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.32.6 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
88% confidence
Finding

The skill depends on sharp 0.32.6, and sharp handles attacker-supplied image files in this skill context. Image-processing libraries frequently expose native-code parsing attack surface through underlying codecs such as libvips/libheif, so known inherited vulnerabilities are especially concerning here because the core purpose of the skill is to ingest and transform untrusted images.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.32.6 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
98% confidence
Finding

The package depends on sharp 0.32.6, which is flagged with known advisories in native image parsing libraries (libvips/libheif). In an image-processing skill that likely handles untrusted user-supplied images, vulnerable parsers substantially increase risk of crashes, denial of service, or potentially memory-corruption-style exploitation through crafted image files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The lockfile metadata identifies the package as "image-merge-skill" with a binary named "image-merge", which does not match the declared skill name and purpose of "image-process" for compression, background removal, and upscaling. This mismatch is a supply-chain integrity concern because it can indicate the wrong package was bundled, repurposed code was shipped without review, or the manifest is misrepresenting what will execute.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documentation describes operations that write output images to disk but does not warn users that files may be created or overwritten. In an agentic context, missing disclosure about filesystem side effects can lead to accidental data loss or unintended modification of user files, even though the skill appears designed for legitimate image processing.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: zod==3.21.4 — 1 advisory(ies): CVE-2023-4316 (Zod denial of service vulnerability)

Low
Category
Supply Chain
Confidence
77% confidence
Finding

Zod 3.21.4 has a documented denial-of-service issue, typically relevant when validating attacker-controlled deeply nested or pathological inputs. In this skill, Zod is transitive under background-removal tooling, so impact is lower than the native image-parser issues, but it can still contribute to resource exhaustion if exposed to untrusted request payloads.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 24)May include surrounding context.

json
"author": "",
  "license": "MIT",
  "dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"dependencies": {
    "@imgly/background-removal-node": "^1.4.5",
    "commander": "^12.0.0",
    "sharp": "^0.32.6"
  }
}

Static analysis

No suspicious patterns detected.