ClawHub
Back to skill

Security audit

cli-anything-gimp

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward GIMP command-line helper, with ordinary image file output risks and a dependency setup process users should verify.

Install only in a dedicated virtual environment, verify the local CLI-Anything agent-harness source before running the editable install, and choose output filenames carefully so image exports do not replace files you care about.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:21
Finding

Unpinned Third-Party Dependencies and Unverified Editable Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-27
Vulnerability Type: Uncontrolled third-party dependency installation
Risk Level: Medium

bash
# Activate the virtual environment and install dependencies
source ~/.openclaw/workspace/cli-anything-venv/bin/activate
pip install click numpy Pillow prompt-toolkit
cd ~/.openclaw/workspace/CLI-Anything/gimp/agent-harness
pip install -e .

Technical Analysis

The skill instructs the agent to install multiple PyPI packages without pinned versions, package hashes, a lockfile, or an explicitly trusted package index. Consequently, the installed artifacts may change over time and cannot be verified against versions reviewed by the skill author.

The subsequent editable installation executes packaging and build logic from a local agent-harness checkout without verifying its repository origin, revision, or integrity. Python package installation can execute attacker-controlled build hooks. Editable mode also leaves the installed command linked to mutable source files, meaning later changes to that checkout can alter tool behavior without another installation.

The troubleshooting instructions repeat unpinned package installation elsewhere in SKILL.md, reinforcing the unsafe installation practice.

Attack Path

  1. An attacker compromises a dependency release, influences the configured Python package index, or tampers with the local CLI-Anything/gimp/agent-harness checkout.
  2. An agent follows the documented setup or troubleshooting instructions.
  3. pip install resolves and downloads an unverified package, or pip install -e . processes the tampered local project.
  4. Malicious packaging or build logic executes with the privileges of the account running the agent.
  5. The malicious component can access resources available to that account and may subsequently run whenever the installed GIMP CLI tool is invoked.

Impact Assessment

Succe ...[truncated 525 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace ad hoc installation commands with a reviewed lockfile containing exact dependency versions.
  2. Require package hashes, such as through pip install --require-hashes -r requirements.txt.
  3. Use an explicitly configured and trusted package index, and prevent fallback to untrusted indexes.
  4. Verify the local agent-harness repository origin and pin it to a reviewed commit or signed release before installation.
  5. Build an immutable wheel from the verified source and install that artifact instead of using editable mode.
  6. Perform installation in an isolated, least-privileged environment without access to sensitive credentials.
  7. Add dependency vulnerability and provenance checks to the release process, and update pinned versions through a controlled review procedure.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill documents export commands that write image files to user-specified paths but does not warn that existing files may be overwritten or that local files will be created/modified. In an agent setting, this increases the chance of unintended data loss or silent modification of user content if the agent chooses an unsafe output path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The workflow examples show creating projects, opening media, editing content, and exporting results, but they do not disclose that these actions produce local artifacts and may alter user-selected images or project files. In the context of an autonomous agent skill, missing warnings reduce user awareness and can lead to accidental modification, replacement, or proliferation of local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill metadata description is written entirely in Chinese, which can impose a specific language/locale on users without opt-in. The policy requires either offering a language choice or clearly documenting and justifying a locale-specific constraint.

Content

No source excerpt is available for this finding.