技能 image-audit
📦
image-audit
v1.1.2 内容修订 r1 高风险 🌐 网络访问📁 文件系统访问⚙️ 外部命令🔑 环境变量
Audit Images for Sensitive Content
Manual image review is slow and inconsistent. This skill compresses image batches, submits them to an MCP moderation service, and summarizes pass, blocked, and failed results.
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "image-audit" from https://skillstore.io/skills/xiaowu89-image-audit.md and its manifest at https://skillstore.io/api/skills/xiaowu89-image-audit/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“image-audit”。 Audit one confirmed image after approving the external upload.
预期结果:
Audit complete: product-front.jpg passed. The service returned no violation details.
正在使用“image-audit”。 Audit a folder containing three supported images.
预期结果:
- banner.jpg: passed
- profile.png: blocked, manual review required
- scan.webp: failed, service timeout
正在使用“image-audit”。 Audit a batch with one unreadable file.
预期结果:
Processed four files: two passed, one blocked, and one failed during compression. The failed file was not uploaded.
安全审计
高风险v1 • 2026/7/28 打开版本化报告
Most static command and reconnaissance findings are Markdown or JavaScript syntax false positives. Confirmed risks include secret exposure, global package installation, external image transfer, unsafe value interpolation, and unbounded image processing.
2
已扫描文件
294
分析行数
16
复核项
0
已忽略误报
已确认安全问题 (4)
高
Unescaped Values Embedded in Executable JavaScript
Image paths, the endpoint, and the API key replace single-quoted placeholders. A crafted value containing a quote can inject JavaScript into the heredoc.
The workflow explicitly requires direct placeholder replacement inside executable single-quoted JavaScript literals, with no escaping or structured argument passing.
高
Unbounded Image Processing Can Exhaust Memory
The script processes every matching file, disables Sharp pixel limits, and retains compressed data twice. Large batches or decompression bombs can exhaust memory.
The code has no file-count or byte limit, sets limitInputPixels to false, and stores each data URL in both records and data_urls.
高
Bulk Image Upload Without Explicit Transfer Consent
The workflow sends compressed local image contents to an external service. It does not require confirmation after naming the destination and selected files.
Both workflows direct the agent to encode local images and submit them externally, but neither requires informed confirmation immediately before transfer.
中
Localized Instructions Use Different Remote Endpoints
The Chinese and English files configure different hardcoded ModelScope endpoint identifiers. Users can send the same images to different service instances by language.
The endpoint strings visibly differ at the same configuration line in the two files, while both are presented as the nx-mcp-audit service.
能力复核项 (16)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
Fetch API call
if(data_urls.length>0){const r3=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({js
This request sends compressed local images and the API key to the configured remote MCP endpoint. The data transfer creates privacy and credential exposure risk.
高
Hidden file in home directory
cat .mcp.json 2>/dev/null || cat ~/.mcp.json 2>/dev/null
The command reads the complete project or home MCP configuration, which can expose unrelated service credentials and endpoints to the agent transcript.
高
Hidden file in home directory
- **有 Key**:帮用户创建 `~/.mcp.json`(用户家目录),全局和项目安装都通用
The skill directs the agent to create a persistent hidden configuration in the user's home directory. It gives no merge or overwrite protection.
高
Hidden file access
cat .mcp.json 2>/dev/null || cat ~/.mcp.json 2>/dev/null
The command prints the complete hidden MCP configuration rather than parsing only this service entry. Other stored secrets can enter logs or model context.
高
Hidden file access
- **有 Key**:帮用户创建 `~/.mcp.json`(用户家目录),全局和项目安装都通用
The instructions authorize writing a hidden home configuration without preserving existing entries. This can persist secrets or damage unrelated MCP configuration.
高
Generic API/secret keys
查找顺序:项目根目录 → 用户家目录。提取 `url` → `MCP_URL`,`env.NX_API_KEY` → `API_KEY`。
The workflow explicitly extracts NX_API_KEY from project or home configuration. This moves a sensitive credential into agent-controlled processing.
高
Generic API/secret keys
- 找到 → 记录 `url` 和 `NX_API_KEY`,继续步骤 2
The agent is told to record the extracted API key for later use. Recording secrets can expose them in model context or execution logs.
高
Generic API/secret keys
替换 `PIC_DIR`、`MCP_URL`、`API_KEY` 后,heredoc 直接通过 stdin 喂给 node,**不写任何文件**:
The workflow substitutes the API key directly into an executable heredoc. This exposes the secret in generated command content and permits unsafe literal interpolation.
高
Generic API/secret keys
const API_KEY='<从.mcp.json读取的NX_API_KEY>';
The actual API key is inserted into a JavaScript string literal. It can be retained in command transcripts and is not protected by environment-based secret handling.
高
Generic API/secret keys
const H={'Content-Type':'application/json','Accept':'application/json, text/event-stream','Authoriza
The extracted secret is placed in an Authorization header for a configurable remote endpoint. Compromised configuration could disclose the credential.
高
Generic API/secret keys
if(data_urls.length>0){const r3=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({js
The API key is sent in the request body together with local image data. The remote service receives the credential beyond the Authorization header.
中
Shell command substitution
NODE_PATH=$(npm root -g) node -e "require('sharp')" 2>/dev/null || npm install -g sharp
This command resolves a global npm path and automatically installs an unpinned package globally. It changes the host environment and introduces supply-chain risk.
低
Hardcoded URL
"url": "https://mcp.api-inference.modelscope.net/274be9de7fd649/mcp"
The instructions configure a fixed external ModelScope MCP endpoint. Images submitted through this configuration leave the local environment.
低
Fetch API call
const r1=await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',id:'1',meth
The script makes an outbound initialization request to the configured MCP endpoint. This is an intentional network side effect.
低
Fetch API call
await fetch(MCP_URL,{method:'POST',headers:H,body:JSON.stringify({jsonrpc:'2.0',method:'notification
The script makes a second outbound MCP notification request. This is an intentional network side effect.
低
Hardcoded URL
"url": "https://mcp.api-inference.modelscope.net/da16b3f65bdb4e/mcp",
The configuration contains a fixed external ModelScope MCP endpoint. The later workflow sends user image data to this destination.
风险因素
🌐 网络访问 (5)
📁 文件系统访问 (12)
⚙️ 外部命令 (47)
SKILL.md:21 SKILL.md:23-35 SKILL.md:35-37 SKILL.md:37 SKILL.md:41-47 SKILL.md:47-49 SKILL.md:49-51 SKILL.md:51 SKILL.md:53-54 SKILL.md:54-60 SKILL.md:60 SKILL.md:62-76 SKILL.md:76-81 SKILL.md:81-82 SKILL.md:82-84 SKILL.md:84-86 SKILL.md:86-88 SKILL.md:88-95 SKILL.md:95-99 SKILL.md:99-100 SKILL.md:100-101 SKILL.md:101-104 SKILL.md:104-118 SKILL.md:118 SKILL.md:119 SKILL.md:120 SKILL.md:121 SKILL.md:122 SKILL.md:123 SKILL.md:124 SKILL.md:130 SKILL.md:131 SKILL.md:132 SKILL.md:133 SKILL.md:134 SKILL.md:135-136 SKILL.md:136 SKILL.md:141-142 SKILL.md:142-143 SKILL.md:143-145 SKILL.md:145-146 SKILL.md:146 SKILL.md:63 SKILL.md:64 SKILL.md:136 SKILL.md:62-76 SKILL.md:136
审计者: codex
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/xiaowu89-image-audit/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/xiaowu89-image-audit?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/xiaowu89-image-audit?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/xiaowu89-image-audit/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/xiaowu89-image-audit.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
xiaowu89. (2026). image-audit security audit report (audit version 1) [Author version 1.1.2]. Skillstore. https://skillstore.io/skills/xiaowu89-image-audit/audits/1BibTeX 引用
@techreport{xiaowu89-xiaowu89-image-audit-2026,
author = {xiaowu89},
title = {image-audit security audit report (audit version 1)},
institution = {Skillstore},
year = {2026},
number = {1},
url = {https://skillstore.io/skills/xiaowu89-image-audit/audits/1},
note = {Author version 1.1.2}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "image-audit security audit report (audit version 1)"
version: "1.1.2"
type: report
authors:
- name: "xiaowu89"
date-released: "2026-07-28"
url: "https://skillstore.io/skills/xiaowu89-image-audit/audits/1"
identifiers:
- type: other
value: "skillstore:xiaowu89-image-audit:audit:1"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
100
可维护性
87
内容
65
社区
91
规范符合性
你能构建什么
Review User Uploads
Screen a controlled batch of uploaded images before publication and identify items needing human review.
Check Product Assets
Audit local product images before release and summarize blocked or failed files for remediation.
Triage Media Libraries
Create a first-pass moderation report for a legacy image collection before detailed manual inspection.
试试这些提示
Audit One Image
Audit the image at [path]. Show the external destination and ask for confirmation before uploading it.
Audit a Folder
Find supported images in [folder]. Report the file count, request upload confirmation, then return a moderation table.
Review Selected Files
Audit only these files: [file list]. Use batches of [size], retry failures once, and separate blocked results from service errors.
Run a Constrained Audit
Audit [folder] with a maximum of [count] files and [bytes] total input. Stop on limits and provide a manual-review queue.
最佳实践
- Confirm the destination and selected files immediately before external transfer.
- Use small, bounded batches and enforce decoded-pixel and total-byte limits.
- Treat blocked results as review signals and inspect failures separately.
避免
- Do not print API keys or complete MCP configuration files.
- Do not upload private images without informed user approval.
- Do not treat automated moderation as a final legal or policy decision.
常见问题
What content can this skill detect?
The service reports adult, political, and violent content classifications.
Does processing remain local?
No. Compression is local, but compressed image data is sent to an external MCP service.
What setup is required?
You need Node.js 18 or later, Sharp, network access, the MCP service, and a valid API key.
Which image formats are supported?
The primary workflow lists PNG, JPEG, WebP, BMP, and TGA files.
Can it audit image URLs?
The English workflow supports URLs, but recommends downloading and submitting compressed data URLs.
Should blocked images be deleted automatically?
No. Review blocked images manually before removal because automated classifications can be incomplete or incorrect.