Security audit

smart-image-loader

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it claims, but it fetches arbitrary URLs and recommends unsafe shell-based cleanup for user-controlled file paths.

Install only if you are comfortable with the agent fetching arbitrary image URLs and writing temporary files. Prefer trusted URLs, avoid unusual filenames, and use safe file-deletion APIs or quoted argument passing instead of raw shell `rm` for cleanup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to fetch remote URLs, which is a network-capable action, but it declares no corresponding permission or user-facing warning. Hidden or undeclared network access is risky because it can surprise users, expand the skill's effective trust boundary, and enable retrieval of attacker-controlled content.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill claims to load images, but its described behavior includes downloading arbitrary URL content to local storage without validating that the response is actually an image. This mismatch is dangerous because it can be used to smuggle unexpected files into the local environment and mislead downstream tooling or users about what was fetched.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation language is broad enough to trigger on many ordinary requests involving images, which increases the chance the skill runs in situations where the user did not intend network access or file handling. Over-broad routing is a security issue here because the skill can download remote content and later invoke cleanup commands.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The condition 'When a user asks to display an image' lacks boundaries around source type, trust level, and whether remote access is permitted. In this skill's context, that ambiguity makes unintended execution more dangerous because displaying an image may silently entail downloading untrusted content and writing it to disk.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill tells the agent to download remote content and delete temporary files, but it does not warn the user that their request will trigger outbound network access and local file deletion. Lack of transparency around these side effects can lead to privacy issues, unexpected data handling, and unsafe trust in attacker-supplied URLs.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The cleanup guidance recommends using exec with `rm <file_path>`, which introduces destructive shell behavior based on a path that may originate from remote input or script output. If path handling is unsafe or spoofable, this can delete unintended files, and even without injection it normalizes unnecessary shell-based deletion for routine cleanup.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.