Trust Assessment
imagemagick received a trust score of 79/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 2 findings: 0 critical, 1 high, 1 medium, and 0 low severity. Key findings include Missing required field: name, Potential Command Injection via ImageMagick arguments.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings2
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Potential Command Injection via ImageMagick arguments The `scripts/remove-bg.sh` script directly passes user-controlled arguments (`$INPUT`, `$OUTPUT`, `$TOLERANCE`) to the `convert` command. While shell variables are quoted, ImageMagick itself has a history of vulnerabilities (e.g., ImageTragick, CVE-2016-3714) where specially crafted filenames or argument values (e.g., containing `|`, `>`, `<`, `@`, or other ImageMagick-specific directives) can lead to arbitrary command execution, unintended file system operations, or denial of service. A malicious user could craft input to exploit such vulnerabilities in the `convert` utility. 1. **Strict Input Validation:** Implement robust validation for `$INPUT` and `$OUTPUT` to ensure they are safe filenames, disallowing any characters or patterns that ImageMagick might interpret as commands or special directives (e.g., `|`, `>`, `<`, `@`, `file.ext" -option`). Consider using a whitelist approach for allowed characters. 2. **Validate `$TOLERANCE`:** Ensure `$TOLERANCE` is strictly a numeric value within the expected range (0-255). 3. **Sandboxing:** Execute the `convert` command in a highly restricted environment (e.g., a container or chroot jail) with minimal filesystem access and network capabilities. 4. **Keep ImageMagick Updated:** Ensure the `convert` utility is always running the latest patched version to mitigate known vulnerabilities. | LLM | scripts/remove-bg.sh:34 | |
| MEDIUM | Missing required field: name The 'name' field is required for openclaw skills but is missing from frontmatter. Add a 'name' field to the SKILL.md frontmatter. | Static | skills/kesslerio/imagemagick/SKILL.md:1 |
Scan History
Embed Code
[](https://skillshield.io/report/273f003bb94112ec)
Powered by SkillShield