Security audit

图像处理基础版

Security checks for vulnerabilities and agentic risk

Overview

This image-processing skill is not clearly scoped and includes unnecessary credential-environment checks and unclear network/API claims.

Review this skill carefully before installing. It may be useful for local ImageMagick-style image operations, but its trigger text should be narrowed to image tasks, the secret-environment check should be removed, and any network/API behavior should be explicitly scoped before use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The manifest describes an image-processing skill but also directs use for data analysis, reporting, statistical insights, and visualization. This scope mismatch can cause the agent to invoke the skill in unrelated contexts, expanding tool exposure and increasing the chance of unnecessary command execution or access to files beyond the user’s intended task.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The trigger condition says the skill should be used for data analysis and visualization even though the body only documents image operations. In an agentic environment, misleading triggers are dangerous because they can steer the agent into loading a skill with exec capability for tasks outside its justified scope.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs verification by enumerating environment variables matching API, KEY, TOKEN, or SECRET, which exposes the presence and names of sensitive credentials without a task-related need for local image processing. In a skill with exec access, normalizing secret inspection materially increases the risk of credential discovery, leakage in logs, or follow-on misuse.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The documentation declares external API and network requirements despite presenting the skill as a local image-processing tool. This broadens the operational scope and can justify unnecessary outbound connectivity, which is risky when the skill also has command execution capability and does not clearly constrain what remote services may be contacted.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill claims that all data is stored locally and not uploaded to the cloud, but elsewhere states that some functions require network access to external APIs. This contradiction can mislead users and agents about data handling guarantees, creating a significant trust and privacy risk if images or metadata are sent off-host unexpectedly.

Vague Triggers

High

Confidence: 95% confidence
Finding: The trigger description is overly broad and mismatched, encouraging activation for general data-analysis tasks rather than narrowly scoped image processing. Because this skill permits exec, overbroad routing criteria increase the chance that an agent invokes command-capable behavior in contexts where it is unnecessary and harder for the user to anticipate.

Vague Triggers

High

Confidence: 91% confidence
Finding: The trigger conditions are ambiguous and insufficiently specific, making it unclear when the skill should or should not be used. Ambiguity is risky for agent routing because it can lead to accidental invocation of exec-enabled functionality in workflows that do not require image tooling.

Static analysis

No suspicious patterns detected.