Security audit

gpt-image-markup-edit

Security checks for vulnerabilities and agentic risk

Overview

The scanners classify this skill as benign because the reported concerns are privacy safeguards and an unpinned installer, with no malicious behavior reported; the overall confidence is medium.

Before installing, consider that images and prompts may be sent to external services, including parts of images outside the marked edit area. Avoid sensitive material unless you are comfortable with that sharing. The installer and source are unpinned, so their contents could change; scan coverage was partial because one referenced path could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

The image-editing workflow lacks a privacy warning about sending user images and prompts to external services.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The README describes uploading images for third-party processing but does not explain the privacy boundary or require informed authorization before sensitive content is sent. External processing is central to the advertised functionality, so this is a privacy-safeguard omission rather than covert exfiltration; it matters particularly for photographs containing people, documents, or confidential information.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The command runs an unpinned npm package through npx and installs skill content from an unpinned repository reference. Although this is an installer rather than an MCP server, a compromised future package release or repository revision could introduce code or agent instructions with access to the user's environment; no compromise is demonstrated here.
Content: No source excerpt is available for this finding.

The workflow uploads user images to external services without a privacy warning.

Medium

Category: Output Handling
Confidence: 91% confidence
Finding: The agent-facing workflow directs uploading both the source image and markup without a privacy check or explicit authorization requirement for sensitive content. Because the full source image is uploaded, material outside the marked editing region is also disclosed to external services; the editing boundary does not provide a confidentiality boundary.
Content: No source excerpt is available for this finding.