Security audit
Security checks for vulnerabilities and agentic risk
The skill is a screenshot-to-page-spec helper, but it requires verbatim extraction of every visible data value from screenshots without privacy limits or redaction guidance.
Install only if users understand that any screenshot they provide may be reproduced as structured text exactly as shown. Avoid using it on screenshots containing credentials, private customer or employee data, financial/account records, internal URLs, or confidential case details unless those values are intentionally meant to be copied into the output.
The skill requires 100% extraction of all visible screenshot content, including operational and personal data, with no filtering or masking. In the context of screenshot analysis, this is especially dangerous because screenshots often contain incidental sensitive information that users did not intend to replicate or expose in a structured response.
The mandated output template requires a complete inventory of all visible text 'unchanged,' which operationalizes data leakage by instructing the model to reproduce sensitive content verbatim. This turns incidental screenshot contents into structured exfiltration in the response, increasing both exposure and persistence of confidential data.
The core principles reinforce retaining every visible character from screenshots, normalizing over-collection and discouraging minimization. This is particularly risky for a page-cloning skill because enterprise UI screenshots commonly include names, departments, IDs, timestamps, case details, and other confidential records that do not need to be preserved verbatim to recreate layout.
The manifest description and the entire skill content are written as mandatory Chinese-language instructions, with no indication that users may choose another language or that the skill is region-specific. This can violate language/locale policy when a skill implicitly forces one language without opt-in.
The skill explicitly instructs verbatim extraction of all visible screenshot text and data, which can include PII, credentials, internal URLs, IDs, and business-sensitive records. Because there is no privacy minimization, redaction guidance, or user warning, the skill promotes over-collection and downstream disclosure in model outputs.
