ClawHub
Back to skill

Security audit

cli-anything-gimp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward GIMP command-line helper, with ordinary image file output risks and a dependency setup process users should verify.

Install only in a dedicated virtual environment, verify the local CLI-Anything agent-harness source before running the editable install, and choose output filenames carefully so image exports do not replace files you care about.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding
Unpinned Third-Party Dependencies and Unverified Editable Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 21-27 **Vulnerability Type**: Uncontrolled third-party dependency installation **Risk Level**: Medium ```bash # Activate the virtual environment and install dependencies source ~/.openclaw/workspace/cli-anything-venv/bin/activate pip install click numpy Pillow prompt-toolkit cd ~/.openclaw/workspace/CLI-Anything/gimp/agent-harness pip install -e . ``` ### Technical Analysis The skill instructs the agent to install multiple PyPI packages without pinned versions, package hashes, a lockfile, or an explicitly trusted package index. Consequently, the installed artifacts may change over time and cannot be verified against versions reviewed by the skill author. The subsequent editable installation executes packaging and build logic from a local `agent-harness` checkout without verifying its repository origin, revision, or integrity. Python package installation can execute attacker-controlled build hooks. Editable mode also leaves the installed command linked to mutable source files, meaning later changes to that checkout can alter tool behavior without another installation. The troubleshooting instructions repeat unpinned package installation elsewhere in `SKILL.md`, reinforcing the unsafe installation practice. ### Attack Path 1. An attacker compromises a dependency release, influences the configured Python package index, or tampers with the local `CLI-Anything/gimp/agent-harness` checkout. 2. An agent follows the documented setup or troubleshooting instructions. 3. `pip install` resolves and downloads an unverified package, or `pip install -e .` processes the tampered local project. 4. Malicious packaging or build logic executes with the privileges of the account running the agent. 5. The malicious component can access resources available to that account and may subsequently run whenever the installed GIMP CLI tool is invoked. ### Impact Assessment Succe ...[truncated 525 chars]
Remediation
## Remediation Suggestions 1. Replace ad hoc installation commands with a reviewed lockfile containing exact dependency versions. 2. Require package hashes, such as through `pip install --require-hashes -r requirements.txt`. 3. Use an explicitly configured and trusted package index, and prevent fallback to untrusted indexes. 4. Verify the local `agent-harness` repository origin and pin it to a reviewed commit or signed release before installation. 5. Build an immutable wheel from the verified source and install that artifact instead of using editable mode. 6. Perform installation in an isolated, least-privileged environment without access to sensitive credentials. 7. Add dependency vulnerability and provenance checks to the release process, and update pinned versions through a controlled review procedure.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents export commands that write image files to user-specified paths but does not warn that existing files may be overwritten or that local files will be created/modified. In an agent setting, this increases the chance of unintended data loss or silent modification of user content if the agent chooses an unsafe output path.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The workflow examples show creating projects, opening media, editing content, and exporting results, but they do not disclose that these actions produce local artifacts and may alter user-selected images or project files. In the context of an autonomous agent skill, missing warnings reduce user awareness and can lead to accidental modification, replacement, or proliferation of local files.

Natural-Language Policy Violations

Low
Confidence
94% confidence
Finding
The skill metadata description is written entirely in Chinese, which can impose a specific language/locale on users without opt-in. The policy requires either offering a language choice or clearly documenting and justifying a locale-specific constraint.

Static analysis

No suspicious patterns detected.