ClawHub
Back to skill

Security audit

Image Resizer图片大小调整裁剪缩放技能

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward local image resize/compression skill, with some dependency and validation hardening issues but no evidence of hidden, deceptive, exfiltrating, or destructive behavior.

Install and run this like a normal local CLI utility, preferably in a project or sandbox without unnecessary credentials. Be aware that npm install will fetch sharp without a lockfile, and avoid processing untrusted images or extreme resize values until the package pins dependencies and adds explicit dimension/resource limits.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:9
Finding

Unpinned Dependency Installation Without a Lockfile

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/resize_image.js:116
Finding

Unbounded Image Dimensions Permit Local Resource Exhaustion

Content
View full analysis
Remediation
View remediation
MAX_DIMENSION || height > MAX_DIMENSION || width * height > MAX_PIXELS ) { throw new Error('Requested image dimensions exceed processing limits.'); } } ``` 4. Call this validation after `calculateDimensions` and before constructing the resize pipeline. 5. Configure `sharp` input pixel limits where appropriate and reject oversized source images before full processing. 6. Run image processing in a worker or isolated container with memory, CPU, execution-time, and disk quotas. 7. Limit compression iterations and terminate processing when a defined CPU-time or attempt budget is exceeded. 8. Return a clear validation error instead of passing malformed or excessive parameters to the image library. ]]>

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing natural-language instructions entirely in Chinese, which can impose a specific language on users without an explicit opt-in or alternative. The policy scope includes language or locale constraints in markdown content, and no language choice or justification is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

该代码文件中的主要用户可见说明、帮助文本和错误提示均为中文，属于自然语言层面的语言/locale 约束。文件中没有提供语言切换、用户选择机制，亦未说明该工具仅面向特定中文环境或区域，因此符合语言策略违规条件。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

showHelp 中所有面向用户的使用说明均固定为中文，命令行用户无法选择其他语言。根据规则，强制单一语言且没有 opt-in 或合理、已记录的区域性限制，属于自然语言政策问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

L097-L099 的帮助示例明确宣称可用通配符进行批量处理，但实际参数解析只保存一个 input 值，主流程在 L466-L471 也仅对单一路径做 existsSync 检查并调用一次 processImage。该文档会让调用方误以为脚本具备批量处理能力，属于注释/帮助文本与实际行为相矛盾。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

运行状态输出如压缩提示、保存结果、错误信息等均为中文，属于用户可见自然语言内容。文件未提供任何语言切换或区域限定说明，因此存在单一语言强制的问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The package description is written only in Chinese, which signals a language-specific skill description without offering users a language choice or documenting that the skill is intentionally region-specific. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The dependency on sharp uses a caret range (^0.32.6), which allows different patch releases to be installed over time. In a security-sensitive supply chain, this reduces build reproducibility and can result in unexpectedly pulling a vulnerable or maliciously compromised release, especially for a package with native components and install-time behavior.

Content

Scanner excerpt · scripts/package.json (reported line 10)May include surrounding context.

json
"resize": "node resize_image.js"
  },
  "dependencies": {
    "sharp": "^0.32.6"
  },
  "keywords": [
    "image",

Unverifiable Dependency: sharp has 4 known advisory(ies) (GHSA-54xq-cgqr-rpm3 (sharp vulnerability in libwebp dependency CVE-2023-4863); GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); CVE-2022-29256 (sharp vulnerable to Command Injection in post-installation over build environmen) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The manifest references sharp without pinning an exact version, while the package family has multiple known advisories, including issues in transitive native libraries and historical install-time risks. Because sharp processes untrusted image data and bundles/depends on complex native code, unresolved version ambiguity materially increases the chance of shipping a build exposed to memory corruption, denial of service, or supply-chain compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

文档在 L017 将 -h 标记为高度参数，但参数解析的 switch 中 L128-L132 已先匹配 '-h' 为 height，导致后面的 L175-L178 帮助分支中的 '-h' 实际不可达。帮助文本和代码共同给出了互相冲突的意图说明，容易误导使用者。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.