image-audit
>-
Install this skill
or
87/100
Security score
The image-audit skill was audited on Jul 28, 2026 and we found 5 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
low line 76
Command substitution pattern
SourceSKILL.md
| 74 | |
| 75 | ```bash |
| 76 | NODE_PATH=$(npm root -g) node -e "require('sharp')" 2>/dev/null || npm install -g sharp |
| 77 | NODE_PATH=$(npm root -g) node << 'AUDITEOF' |
| 78 | const fs=require('fs'),path=require('path'),sharp=require('sharp'); |
low line 77
Command substitution pattern
SourceSKILL.md
| 75 | ```bash |
| 76 | NODE_PATH=$(npm root -g) node -e "require('sharp')" 2>/dev/null || npm install -g sharp |
| 77 | NODE_PATH=$(npm root -g) node << 'AUDITEOF' |
| 78 | const fs=require('fs'),path=require('path'),sharp=require('sharp'); |
| 79 | let PIC_DIR='<目标图片目录绝对路径>'; |
medium line 149
Command substitution pattern
SourceSKILL.md
| 147 | | `"未配置 API Key"` | 没传 `apiKey` | **必须传**，工具定义说可选是误导 | |
| 148 | | `413 Payload Too Large` | payload 超限 | 压缩后通常 < 200KB，不触发；未压缩大图需分批 | |
| 149 | | `Cannot find module 'sharp'` | 未全局安装或缺少 NODE_PATH | `NODE_PATH=$(npm root -g) node ...` | |
| 150 | |
| 151 | ## 禁止事项 |
low line 61
Access to home directory dotfiles
SourceSKILL.md
| 59 | |
| 60 | ```bash |
| 61 | cat .mcp.json 2>/dev/null || cat ~/.mcp.json 2>/dev/null |
| 62 | ``` |
| 63 |
medium line 66
Access to home directory dotfiles
SourceSKILL.md
| 64 | - 找到 → 记录 `url` 和 `NX_API_KEY`，继续步骤 2 |
| 65 | - 找不到 → 询问用户是否已有 API Key： |
| 66 | - **有 Key**：帮用户创建 `~/.mcp.json`（用户家目录），全局和项目安装都通用 |
| 67 | - **没有 Key**：告知联系服务提供商获取，等用户拿到后回来配置 |
| 68 |
Scanned on Jul 28, 2026
View Security Dashboard