image-utils Audit report.

Warnings

• Dependency or permission surface needs review
• Permission surface may require sandboxing
• Image loading from URLs does not appear to enforce a maximum file size or decompression-bomb limit, which can be risky when processing untrusted images.
• URL loading also does not restrict schemes or network targets; if exposed to untrusted user input, this could enable SSRF-style access to internal resources.
• SKILL.md does not explain how the image_utils.py module becomes importable, since the code lives under references/code-examples; agents may not know how to install or reference it.
• There is no explicit limitations section covering EXIF orientation, ICC color profiles, alpha handling, or recompression artifacts from lossy format conversion.
• Quality score needs review
• Permission surface needs review: shell or command execution, filesystem or document access
• GitHub adoption: 65 GitHub stars
• Stars/forks activity: 65 stars, 6 forks; issue activity unavailable in current metadata
• Dependency/runtime risk: command execution surface, external package install surface
• Permission surface: shell or command execution, filesystem or document access

Method

This report combines public metadata, AI review output, repository freshness, install readiness, OpenAgentSkill events, quality scoring, trust checks, and the agent safety gate. It is not a full source-code security review.