Reverse Image Search

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:36 AM UTC
• Version: 1.0.4

Overview

The skill matches its reverse-image-search purpose, but its command examples could mishandle crafted user input and run local commands.

Install only if you are comfortable sending searched images or image URLs to SearchThisImage. Use extra care with private, confidential, or regulated images, and prefer a hardened implementation that serializes JSON safely, validates HTTPS image URLs, creates trusted temporary files, and avoids building shell commands from raw user input.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Shell Command Injection Through an Untrusted Image URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–42
Vulnerability Type: Shell command injection through unsafe placeholder substitution
Risk Level: High

Vulnerable Code

bash

curl -s -X POST https://api.searchthisimage.com/api/v1/search/url \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -d '{"image_url": "IMAGE_URL_HERE"}'

Technical Analysis

The skill instructs the agent to replace IMAGE_URL_HERE with a user-provided image URL inside a single-quoted shell argument. If this replacement is performed by constructing shell source text, an attacker can supply an image URL containing an apostrophe followed by shell operators. The apostrophe terminates the quoted JSON argument, allowing the remaining content to be interpreted by the shell rather than treated exclusively as URL data.

The vulnerability is conditional on the agent performing literal textual substitution and then executing the resulting command through a shell. The project does not provide a safe serializer, argument-array implementation, or input validation that would prevent this interpretation.

Attack Path

1. An attacker submits a purported image URL containing shell quoting characters, command separators, and an attacker-selected command.
2. The agent replaces IMAGE_URL_HERE with the supplied value in the documented command.
3. The injected apostrophe terminates the single-quoted curl data argument.
4. The shell parses the following metacharacters and text as a separate command.
5. The injected command executes with the operating-system privileges and environment available to the agent process.

Impact Assessment

Successful exploitation permits arbitrary command execution under the agent process account. The attacker could read or modify files accessible to that account, access environment variables such as SEARCHTHISIMAGE_API_KEY, invoke network utilities, t ...[truncated 197 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct executable shell source by replacing placeholders with user-controlled values.

• Use an HTTP client API that accepts arguments and request bodies as structured values without invoking a shell.

• If curl must be used, construct the JSON body with a safe serializer such as jq:

  bash

  payload="$(jq -n --arg image_url "$IMAGE_URL" '{image_url: $image_url}')"
  curl -sS -X POST 'https://api.searchthisimage.com/api/v1/search/url' \
    -H 'Content-Type: application/json' \
    -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
    --data-binary "$payload"
  

• Pass the URL through a variable as a distinct argument rather than inserting it into command text.

• Validate that the supplied URL uses an explicitly permitted scheme such as https.

• Reject control characters and enforce reasonable URL length limits.

• Run the skill with least privilege, a restricted environment, and outbound network controls to reduce the consequences of any future injection flaw.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:50

Finding

Shell Command Injection Through an Unsafe Uploaded-File Path

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–52
Vulnerability Type: Shell command injection through unsafe file-path substitution
Risk Level: High

Vulnerable Code

bash

curl -s -X POST https://api.searchthisimage.com/api/v1/search/upload \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -F "file=@/path/to/image.jpg"

Technical Analysis

The skill instructs the agent to save an uploaded image to a temporary path and then use that path in a shell command. The documented command places the path inside double quotes but does not define a safe method for supplying the dynamically generated value.

If an implementation replaces /path/to/image.jpg directly in the shell command text, malicious or insufficiently controlled path content can introduce shell substitutions or terminate the quoted argument. Double quotes do not suppress command substitution contained in shell source. This can result in command execution before curl processes the upload argument.

The issue is avoidable when the temporary file name is generated entirely by trusted code and passed as a variable argument. However, those protections are not required by the current instructions.

Attack Path

1. An attacker influences an uploaded file name or another value used to derive the temporary path.
2. The resulting path contains shell-significant syntax, such as command substitution or quote-termination characters.
3. The agent inserts the path directly into the documented shell command.
4. The shell evaluates the injected syntax while preparing the curl invocation.
5. The attacker-selected command runs with the privileges of the agent process.

Impact Assessment

Exploitation can provide arbitrary command execution under the agent account, allowing access to readable files, environment credentials, workspace content, and available network resources. It may also permit file modification or deletion within th ...[truncated 178 chars]

Remediation

View remediation

Remediation Suggestions

• Generate temporary files internally with a trusted mechanism such as mktemp; do not derive executable command text from the original uploaded file name.

• Store the generated path in a variable and pass it as a distinct shell argument:

  bash

  upload_path="$(mktemp)"
  # Write the uploaded image to "$upload_path" using a non-shell API.
  curl -sS -X POST 'https://api.searchthisimage.com/api/v1/search/upload' \
    -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
    --form "file=@${upload_path}"
  

• Prefer direct process execution with an argument array rather than a shell command string.

• Ensure the temporary file is created with restrictive permissions and removed after the request.

• Verify that the selected upload path refers to the expected regular file and does not traverse symbolic links or attacker-controlled directories.

• Apply file-size and file-type restrictions before transmitting uploaded content.

• Execute the skill with least privilege and avoid exposing unrelated secrets in its environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This finding reflects the same external transmission behavior at the explicit API endpoint: user-controlled input is sent to https://api.searchthisimage.com for processing. In context, this is expected functionality for reverse image search, but it is still a genuine security/privacy concern because the skill sends potentially sensitive data outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

If the user provides an image URL (a direct link to an image), use:

bash

curl -s -X POST https://api.searchthisimage.com/api/v1/search/url \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -d '{"image_url": "IMAGE_URL_HERE"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This finding reflects the same external transmission behavior at the explicit API endpoint: user-controlled input is sent to https://api.searchthisimage.com for processing. In context, this is expected functionality for reverse image search, but it is still a genuine security/privacy concern because the skill sends potentially sensitive data outside the local trust boundary.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

If the user provides an image URL (a direct link to an image), use:

bash

curl -s -X POST https://api.searchthisimage.com/api/v1/search/url \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -d '{"image_url": "IMAGE_URL_HERE"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The upload flow sends the actual user image file to an external API, which is a direct transfer of potentially sensitive content to a third party. Although this is aligned with the skill's purpose, it increases privacy and compliance risk, especially if users upload personal, confidential, or regulated images.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

If the user sends/uploads an image file, first save it to a temporary path, then use:

bash

curl -s -X POST https://api.searchthisimage.com/api/v1/search/upload \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -F "file=@/path/to/image.jpg"

Static analysis

No suspicious patterns detected.