Image Optimizer Tool

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:36 AM UTC
• Version: 1.0.0

Overview

This is a disclosed local image optimization tool with ordinary file-modification behavior, though users should note the unpinned dependency and backup-path bug.

Before installing, prefer running it in a virtual environment, pin or review the Pillow dependency, and use preview or output-dir first. Avoid running it from one directory while targeting images elsewhere until the backup path handling is fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: install.sh:17
• Finding: Unpinned Third-Party Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:17-18` **Vulnerability Type**: Uncontrolled third-party package version **Risk Level**: Medium ### Vulnerable Code ```bash echo "📦 正在安装 Pillow..." pip install Pillow ``` ### Technical Analysis The installation script retrieves Pillow without pinning an exact, reviewed version or verifying a package integrity hash. Consequently, the installed code depends on whichever release the configured package index resolves at installation time. Although Pillow is a legitimate package, an unpinned installation is not reproducible and unnecessarily exposes users to compromised releases, package-index interference, or an incompatible future version. Python packages and their installation hooks can execute code with the privileges of the user running `pip`. The script checks for `python3` but invokes the standalone `pip` executable. That executable may belong to a different Python installation, causing the dependency to be installed into an unintended environment. ### Attack Path 1. An attacker compromises a future dependency release or interferes with the package source configured for `pip`. 2. A user executes `install.sh`. 3. `pip install Pillow` resolves and downloads the uncontrolled package version from that source. 4. Package installation code executes with the privileges of the user running the installer. 5. The malicious or compromised dependency can access files, environment variables, credentials, and other resources available to that user. ### Impact Assessment Successful exploitation would permit code execution with the installer user's privileges. The affected scope includes that user's files, credentials available in the environment, Python environments, and network access. Running the installer with elevated privileges would increase the impact, although the script does not itself request elevation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin Pillow to an exact, reviewed version rather than resolving the latest available release. - Store dependencies in a lock file or hashed requirements file. - Require integrity verification during installation, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` - Generate and review package hashes using a trusted dependency-locking workflow rather than manually inserting unverified hashes. - Use `python3 -m pip` so that the package is installed for the same interpreter validated by the script. - Install into an isolated virtual environment and avoid running the installer with administrative privileges. - Regularly review and update the pinned version after security testing. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: source/image_optimizer.py:51
• Finding: Backup Destination Path Can Escape the Intended Backup Directory<![CDATA[ ## Vulnerability Details **File Location**: `source/image_optimizer.py:51-58` **Vulnerability Type**: Path traversal in backup destination construction **Risk Level**: Low ### Vulnerable Code ```python for file_path in files: rel_path = os.path.relpath(file_path) backup_path = os.path.join(session_backup_dir, rel_path) backup_subdir = os.path.dirname(backup_path) if not os.path.exists(backup_subdir): os.makedirs(backup_subdir, exist_ok=True) shutil.copy2(file_path, backup_path) backup_map[file_path] = backup_path ``` ### Technical Analysis `os.path.relpath(file_path)` calculates a path relative to the process's current working directory, not relative to the image directory selected through `--directory`. When an image is outside the current working directory, the resulting path can contain one or more `..` components. The code joins this unchecked relative path to `session_backup_dir`. `os.path.join()` does not enforce directory containment, so resolving the resulting path can escape the session backup directory. The subsequent `os.makedirs()` and `shutil.copy2()` operations therefore may create directories or overwrite a file outside `.image_optimizer_backup`. No canonical-path containment validation is performed before the copy. The affected destination is deterministic from the current working directory, backup directory, and selected input path. ### Attack Path 1. The tool is run from one directory while `--directory` identifies an image directory elsewhere in the filesystem. 2. `get_image_files()` returns paths outside the current working directory. 3. `os.path.relpath(file_path)` produces a path containing parent-directory components such as `../`. 4. That path is appended to `.image_optimizer_backup/<timestamp>/`. 5. Filesystem path resolution processes the parent components and escapes the intended session backup directory. 6. `shutil.copy2()` writes the source image to the escaped destination, potential ...[truncated 528 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Derive each backup path relative to the explicitly selected image root rather than the process's current working directory. - Canonicalize the source root, source file, session directory, and destination with `Path.resolve()`. - Reject files whose resolved paths are outside the selected source root. This also prevents file symlinks from escaping that root. - Verify that every resolved destination remains under the resolved session backup directory before creating directories or copying data. - Treat containment failures as per-file errors instead of proceeding with the copy. - Use logic equivalent to: ```python source_root = Path(args.directory).resolve() session_root = Path(session_backup_dir).resolve() source_path = Path(file_path).resolve() relative_path = source_path.relative_to(source_root) backup_path = (session_root / relative_path).resolve() if backup_path != session_root and session_root not in backup_path.parents: raise ValueError("Backup destination escapes the session directory") backup_path.parent.mkdir(parents=True, exist_ok=True) shutil.copy2(source_path, backup_path) ``` - Add tests covering absolute input directories, parent-directory paths, symbolic links, destination collisions, and nested recursive input. ]]>

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises file-processing behavior that necessarily reads and writes local files, but its manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and transparency problem: a host or user cannot clearly assess or constrain what filesystem access the skill needs, increasing the chance of unintended file modification or abuse if the implementation is changed or invoked in an unsafe context.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains natural-language strings that present the tool and its usage exclusively in Chinese. Under the policy, forcing a specific language without opt-in or a documented regional justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This shell script presents all user-facing comments and console output in Chinese, including installation status, errors, and usage guidance. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue when no alternative or choice is provided.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The skill description is written entirely in Chinese, which implies a language-specific user experience without offering a language choice or documenting that the skill is intended only for a Chinese-speaking audience. Under the language/locale policy rule, this is a natural-language policy concern because the manifest does not indicate user opt-in or a justified region-specific constraint.

Static analysis

No suspicious patterns detected.