Skills/npm/imagemagick-skill

imagemagick-skill@0.10.0

VERIFIED· startup only

Publisher claims: "Agent Skill that gives coding agents (Claude Code, Cursor, Codex) a local ImageMagick image editor that never overwrites originals: probe, convert, resize, thumbnail, EXIF/GPS strip, trim, check. Formerly image-skill." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher kajisho5 · publishing for 72 daysInstalls 678Last detonated 1 h ago
$claude mcp add imagemagick-skill -- npx -y imagemagick-skill
WatchReport an issue

Coverage

Startup only; authenticated tool behavior not tested.
Tested
server startup over stdio (initialize sent) · every file read, file written and host contacted by what ran
Not tested
the tool list (the server exited before answering) · what the tools do when called with real credentials

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; startup only; authenticated tool behavior not tested) on 2026-11-14 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 20 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
20sclaimedstartup only: exited (0) before answering · (Use `node --trace-warnings ...` to show where the warning was created) installed: /tmp/ks-detonate-aVzHL3/task/home/.claude/skills/imagemagick-skill Already installed? Re-running replaces the copy with whatever version you run. Next: npx imagemagick-skill doctor
20sprocessscript backend runs setup only
20sprocessno install scripts to re-run

Static findings

MEDIUM
Process kill commandscripts/_common.py:245 · Process kill command — agent can terminate processes"""Start the child as the leader of a new process group, so a timeout can killFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandscripts/_common.py:341 · Process kill command — agent can terminate processesexcept subprocess.TimeoutExpired: # a pipe still held open by something the kill missedFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_contract.py:704 · Python subprocess execution detectedpolicy = subprocess.run([magick, "-list", "policy"], capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common.py:329 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedmcp/server.py:82 · Python subprocess execution detectedproc = subprocess.Popen(cmd, stdin=subprocess.DEVNULL, stdout=subprocess.PIPE, stderr=subprocess.PIPE,Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
HIGH
Privileged sudo commandscripts/_contract.py:738 · Privileged sudo command — agent may execute with elevated privileges"the libheif decoder plugin is missing (Debian/Ubuntu: `sudo apt install libheif-plugin-libde265`)"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_contract.py:703 · Python subprocess execution detectedformats = subprocess.run([magick, "-list", "format"], capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandscripts/_common.py:275 · Process kill command — agent can terminate processesproc.kill() # the direct child, in case the group kill did not reach itFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Python subprocess execution detectedscripts/_contract.py:705 · Python subprocess execution detectedversion = subprocess.run([magick, "-version"], capture_output=True, text=True, timeout=30)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common.py:266 · Python subprocess execution detectedsubprocess.run([_taskkill(), "/T", "/F", "/PID", str(proc.pid)], capture_output=True, timeout=10)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_contract.py:728 · Python subprocess execution detectedproc = subprocess.run(magick_argv([magick, "identify", "-format", "%m", path]),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:26 · npx invocation of non-well-known package — may execute untrusted codenpx imagemagick-skill contract --jsonFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandbin/install.js:200 · Privileged sudo command — agent may execute with elevated privilegesconsole.warn(" Debian/Ubuntu: sudo apt install imagemagick");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:202 · npx invocation of non-well-known package — may execute untrusted codeconsole.warn(" Then check: npx imagemagick-skill doctor");Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Python subprocess execution detectedscripts/_contract.py:719 · Python subprocess execution detectedsubprocess.run(magick_argv([magick, "-size", "16x16", "xc:#808080", path]),Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Python subprocess execution detectedscripts/_common.py:118 · Python subprocess execution detectedout = subprocess.run([path, "-version"], capture_output=True, text=True, timeout=10).stdoutFix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
npx invocation of non-well-known packagebin/install.js:24 · npx invocation of non-well-known package — may execute untrusted codeconst USAGE = `usage: npx imagemagick-skill [target] [--uninstall]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/install.js:25 · npx invocation of non-well-known package — may execute untrusted codenpx imagemagick-skill doctor [--json]Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagebin/install.js:27 · npx invocation of non-well-known package — may execute untrusted codenpx imagemagick-skill --helpFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,182 tok
1 file · 32 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for imagemagick-skill@0.10.0 as of 47 min ago. This is the package itself, not its dependencies.