ClawHub
Back to skill

Security audit

Image Compressor

Security checks for vulnerabilities and agentic risk

Overview

This image-compression skill is mostly coherent, but it needs review because it can run an unpinned npm CLI and upload local files with supplied auth data.

Review before installing. Prefer a pinned, vetted `rv-image-optimize` version or a lockfile-managed local binary, and only use upload or pipeline commands with endpoints and credentials you trust. Avoid putting live cookies or bearer tokens into prompts, and use preview mode before real uploads when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned Third-Party Package Installation and Execution

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:13-16
  • SKILL.md:77-79
  • reference.md:7-14

Vulnerability Type: Unpinned and mutable npm dependency execution
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:13-16:

yaml
- kind: node
  package: rv-image-optimize
  bins:
    - rv-image-optimize

SKILL.md:77-79:

bash
npx rv-image-optimize "{input}" --output-dir "{outputDir}" --format webp --quality 82 --json

reference.md:7-14:

bash
npm install rv-image-optimize
bash
npx rv-image-optimize ./images --output-dir ./compressed --format webp --quality 82 --json

Technical Analysis

The Skill instructs the Agent to install or execute rv-image-optimize without an exact package version, lockfile, or integrity hash. Both npm install rv-image-optimize and npx rv-image-optimize can resolve the package version from the npm registry at execution time.

Consequently, the executable code used by the Skill can change after this repository has been audited. If the package, maintainer account, publishing credentials, or registry resolution path is compromised, a later package release could introduce malicious installation lifecycle scripts or malicious CLI behavior. The fallback to npx is particularly sensitive because it may download and immediately execute a package that is not already installed locally.

This finding does not establish that the current rv-image-optimize package is malicious. The vulnerability is the absence of dependency pinning and integrity controls around remotely sourced executable code.

Attack Path

  1. An attacker compromises the npm package, a maintainer account, or the relevant package publishing workflow.
  2. The attacker publishes a malicious version under the existing rv-image-optimize package name.
  3. An Agent follows the Skill instructions and runs npm install rv-image-optimize or the documented `n ...[truncated 1058 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an audited exact version rather than resolving the latest release:

    yaml
    - kind: node
  package: rv-image-optimize@3.0.30
  bins:
    - rv-image-optimize

  2. Update installation examples to use the same exact version:

    bash
    npm install --save-exact rv-image-optimize@3.0.30
npx --package=rv-image-optimize@3.0.30 rv-image-optimize ./images --output-dir ./compressed --format webp --quality 82 --json

  3. Prefer a preinstalled, reviewed binary over automatic npx downloading. If the required verified binary is unavailable, stop and request user approval rather than silently fetching the latest package.

  4. Maintain a lockfile and verify package integrity using npm lockfile integrity metadata or an independently recorded package hash.

  5. Review package provenance, maintainer changes, lifecycle scripts, and release contents before updating the pinned version.

  6. Execute image-processing dependencies in a restricted environment with minimum filesystem permissions, no unnecessary credentials, and constrained outbound network access.

  7. Separate compression and upload privileges where practical so that image conversion code does not automatically inherit access to upload tokens or unrelated sensitive files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The skill declares use of npx and an unpinned Node package (rv-image-optimize) in its install/execute path, which can pull whatever version is current at runtime. That creates a supply-chain risk: a malicious or compromised upstream release could be fetched and executed by the agent without review, leading to arbitrary code execution in the agent environment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The 'When to use' section lists short generic phrases such as '压缩图片', '图片太大', '减小文件大小', and '让 Agent / CLI 自动处理图片' without tighter constraints or exclusion conditions. These broad triggers could match ordinary conversation and cause unintended invocation beyond clearly scoped image-optimization tasks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Phrases like 'reduce image file size' and 'run image optimization from an agent or CLI workflow' are useful but still broad, and the file does not define when similar requests should not invoke this skill. Without negative examples or narrower context, these conditions may overlap with general-purpose file handling or broader automation tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The fallback command npx rv-image-optimize executes a package by name without an explicit pinned version, which may download and run the latest published package. If the package or one of its transitive dependencies is compromised, the skill can become a code-execution vector during normal use.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The skill recommends running npx rv-image-optimize without pinning an exact package version. npx can fetch the latest published package at execution time, so a compromised upstream release or unexpected update could cause agents to run unreviewed code. In an agent workflow, this increases supply-chain risk because execution may be automated and non-interactive.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

This example uses npx rv-image-optimize upload ... without an exact version, which permits execution of whatever package version is current at runtime. Because this command performs uploads, a malicious or changed upstream package could process local files and network destinations in unsafe ways, amplifying supply-chain exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The chunked upload example again relies on unpinned npx, allowing a fresh package download and execution at runtime. Since the operation handles large file uploads and resumable logic, compromise of the package could expose files, credentials, or alter upload behavior without the user noticing.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The pipeline example combines compression and upload while using unpinned npx, creating both code-execution and data-exfiltration risk if the upstream package changes or is compromised. In an automated agent context, the lack of version pinning is more dangerous because the tool may be executed repeatedly across different environments without manual review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The upload and pipeline guidance documents how to send files, headers, cookies, and authorization data to arbitrary endpoints but does not clearly warn that this transmits local content and sensitive request metadata off-host. In an agent skill, omission of that warning can lead to unintended exfiltration of images, session cookies, bearer tokens, or internal URLs, especially when users treat examples as safe defaults.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The document is consistently bilingual in Chinese and English, which imposes a specific language/locale presentation style. Under the policy rule, language constraints should either be optional for the user or clearly documented as justified; this file does not state that bilingual output is optional or required for a specific region/compliance context.

Content

No source excerpt is available for this finding.