Image Resizer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local image resizing helper with a normal Pillow dependency and no evidence of hidden network, persistence, credential, or destructive behavior.

Safe to use for local image resizing. Install dependencies in a virtual environment when possible, consider pinning Pillow to a reviewed version, and only run batch resizing on directories you intentionally choose because it will create output files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:7

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7
Vulnerability Type: Unpinned runtime dependency
Risk Level: Low

Vulnerable Code Snippet:

yaml

dependencies: "pip install pillow"

Technical Analysis

The Skill directs users or agents to install Pillow without specifying a reviewed version, cryptographic hashes, a lockfile, or a trusted package index. Dependency resolution therefore relies on mutable third-party repository state at installation time.

The package name is consistent with the code's PIL import, and the audit found no evidence that the Skill intentionally uses dependency confusion or typosquatting. Nevertheless, an unconstrained installation is not reproducible and could retrieve a compromised, malicious, or unexpectedly incompatible future release.

Attack Path

1. A user or agent loads the Skill and follows its dependency instruction.
2. pip install pillow resolves the package from the configured Python package index at runtime.
3. If the selected upstream release, package-distribution channel, or local package-index configuration has been compromised, malicious package content is downloaded.
4. Malicious installation behavior may execute during installation, or malicious library code may execute when the image-resizing code imports or invokes Pillow.
5. The payload operates with the privileges of the account running pip or the image-resizing process.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution under the installing user's privileges. This could expose files, environment variables, and other resources accessible to that account and could modify its Python environment. The scope does not inherently include elevated system privileges unless installation is performed as an administrator or root user.

No network exfiltration, persistence, privilege escalation, prompt hijacking, or embedded malicious payload was observe ...[truncated 32 chars]

Remediation

View remediation

Remediation Suggestions

• Pin Pillow to a specifically reviewed version instead of resolving the latest release dynamically.
• Store dependencies in a version-controlled requirements or lock file.
• Require cryptographic hashes, for example through pip install --require-hashes -r requirements.txt.
• Configure an explicitly trusted package index and avoid unreviewed mirrors.
• Install the dependency in an isolated, non-privileged virtual environment.
• Periodically review and update the pinned version for security fixes, regenerating and validating hashes during each approved update.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill presents its name, heading, and operational description primarily in Chinese while also including some English text, but it does not state that the user can choose their preferred language. That can amount to a language/locale policy issue because the skill appears to assume a specific language without explicit opt-in or alternative-language guidance.

Content

No source excerpt is available for this finding.