Security audit

gpt-image-sticker-pack

Security checks for vulnerabilities and agentic risk

Overview

ClawScan’s verdict is benign with medium confidence: the reviewed material raised privacy, installer-version, and export-validation concerns, while part of the executable script was only partially analyzed.

Before installing, consider whether you are comfortable with personal photos being processed by third-party services, and review the installer source and version because they are not pinned. The scanners also reported a possible export-validation error. Coverage was partial: one script was not fully analyzed, so the benign verdict is not a guarantee that every behavior is safe.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied shell commands are installation instructions, not the declared sticker-generation workflow. Installing the named skill could be a supporting setup step, but the broader plugin installation extends beyond that skill, and this chunk provides no evidence of the advertised creation and validation behavior. This assessment is limited to the supplied README excerpt; it does not establish what the installed skill actually does.
Content: No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
md
2026-11-05). scripts/export.sh needs bash, ffmpeg + ffprobe (libvpx-vp9 for Telegram) and

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
md
5. **Export**: `bash scripts/export.sh sticker.gif all` (section 5).

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.
md
## 5. Export: scripts/export.sh

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.
md
bash scripts/export.sh thanks.gif all # every platform -> thanks_stickers/

Incomplete referenced artifact analysis

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.
md
bash scripts/export.sh thanks.gif line out/ # one platform, chosen folder

Photo-based generation lacks an explicit third-party data-sharing warning.

Medium

Category: Output Handling
Confidence: 90% confidence
Finding: The README promotes processing selfies and other personal photos through varg without explicitly warning that images leave the user's environment for third-party processing. Naming the service provides some context, but does not clearly establish informed consent to disclose potentially sensitive images.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The installation command runs an unpinned npm package and fetches skill content from a mutable repository reference. Although this is a skill installer rather than an MCP server, a compromised future package or repository update could introduce code or agent instructions that were not reviewed.
Content: No source excerpt is available for this finding.

The photo-generation workflow lacks a privacy warning about third-party image processing.

Medium

Category: Output Handling
Confidence: 92% confidence
Finding: The workflow directs the agent to use a person's photo in an external image-generation request without explicitly obtaining approval for third-party processing. Requiring the subject to agree to use of the photo is helpful, but does not establish consent to upload it to varg and its processing providers.
Content: No source excerpt is available for this finding.

Discord's GIF fallback can report successful validation for an animation exceeding the declared five-second limit.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: The Discord APNG path uses selected frames and shortened delays, but its GIF fallback calls shrink_gif, which restores all original frames and delays. Validation still checks SEL_TOTAL rather than the actual GIF duration, so an animation longer than five seconds can receive a successful result; the demonstrated impact is incorrect validation and platform rejection, not code execution.
Content: No source excerpt is available for this finding.