Reverse Image Search

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:24 PM UTC
• Version: 1.0.4

Overview

This skill is a straightforward reverse image search integration, but using it sends image URLs or uploaded image files to SearchThisImage.

Install only if you are comfortable sending searched images or image URLs to SearchThisImage. Avoid private, regulated, or confidential images unless the provider's privacy terms meet your needs, use a dedicated API key, and ensure temporary image files are deleted after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration

Content

If the user provides an image URL (a direct link to an image), use:

```bash
curl -s -X POST https://api.searchthisimage.com/api/v1/search/url \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -d '{"image_url": "IMAGE_URL_HERE"}'

• Confidence: 86% confidence
• Finding: This finding identifies the external endpoint itself, confirming that the skill depends on a remote service for processing. The danger is not code execution but external transmission of potentially sensitive user-provided image references to a third party, which may expose private content, internal URLs, or tracking-related metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

If the user provides an image URL (a direct link to an image), use:

```bash
curl -s -X POST https://api.searchthisimage.com/api/v1/search/url \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -d '{"image_url": "IMAGE_URL_HERE"}'

• Confidence: 86% confidence
• Finding: This finding identifies the external endpoint itself, confirming that the skill depends on a remote service for processing. The danger is not code execution but external transmission of potentially sensitive user-provided image references to a third party, which may expose private content, internal URLs, or tracking-related metadata.

External Transmission

Medium

• Category: Data Exfiltration

Content

If the user sends/uploads an image file, first save it to a temporary path, then use:

```bash
curl -s -X POST https://api.searchthisimage.com/api/v1/search/upload \
  -H "X-API-Key: $SEARCHTHISIMAGE_API_KEY" \
  -F "file=@/path/to/image.jpg"
```

• Confidence: 96% confidence
• Finding: The upload flow transmits the actual user image file to an external API, which is a direct privacy and confidentiality risk if users submit personal, proprietary, or regulated images. The skill context makes this transmission expected, but the included assurances that data is 'not stored, logged, or retained' are unverified claims and should not be trusted as a security control.

Static analysis

No suspicious patterns detected.