Security audit

sn-da-image-caption

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent image-captioning helper, but users should treat analyzed images and cached captions as potentially sensitive.

Install only if you are comfortable with selected images being sent to the configured vision API. Avoid processing confidential screenshots unless the endpoint is trusted, use --no-cache for sensitive work, and review or delete the local caption cache when needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documentation describes use of environment variables, reading image inputs, and writing outputs/cache files, but no permissions are declared to make those capabilities explicit. This is dangerous because it obscures the skill's actual access requirements and can mislead reviewers or users about what data the skill can read, write, or exfiltrate via configured API credentials.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill description claims broad built-in capabilities such as structured parsing, chart regeneration, and Excel/CSV export, but the documented core behavior is primarily invoking an external captioning script and providing example downstream code. The mismatch is dangerous because users may rely on capabilities, privacy properties, and processing scope that are not actually implemented or may not realize that arbitrary directories can be batch-processed and external API configuration/override is involved.

Context-Inappropriate Capability

Low

Confidence: 82% confidence
Finding: Allowing callers to override the API base URL means image data and prompts can be sent to any attacker-controlled endpoint, defeating the 'preconfigured' trust model. In a skill that processes potentially sensitive screenshots, charts, and tables, this materially increases exfiltration risk and can silently redirect data off-platform.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill sends image content to an external vision model/API, but the user-facing description says it works 'without extra API key configuration' and does not warn that uploaded images may leave the local environment. This is dangerous because screenshots, charts, and tables often contain sensitive or regulated data, and users are not given informed consent about external transmission.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script base64-encodes the full image and sends it to an external vision API without any explicit disclosure or consent mechanism. Because this skill is designed for screenshots, tables, and diagrams that may contain proprietary or personal data, silent transmission to a third-party service creates a real confidentiality risk.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: Caption output is persisted on disk in a local cache directory without clear disclosure, which can retain extracted text from sensitive images longer than users expect. While the cache stores results rather than raw images, those results may still contain confidential text, table contents, or UI details.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.