Chalk Art Image Generator

• Outcome: Review
• Latest audit: May 28, 2026 · 7:39 AM UTC
• Version: 1.0.1

Overview

This appears to be a real WeryAI image-generation skill, but it needs review because it is broader and more persistent than a simple chalk-art tool.

Review before installing. Use a scoped, revocable WeryAI API key, avoid persisting it to project files unless you trust the workspace, do not enable webhooks or web search unless you intend external sharing, and approve setup/bootstrap actions only after checking what files they will change.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (28)

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documented scope claims a chalk-art-only capability, while the rest of the file describes a much broader image-generation platform. Scope deception matters in agent ecosystems because skill selection, user consent, and governance decisions may rely on the manifest summary rather than the full document.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The file claims strict chalk-style enforcement, but later provides generic prompts and arbitrary style options such as cinematic and editorial. This inconsistency weakens trust boundaries and can mislead upstream agents into believing prompt output is constrained when it is not.

Context-Inappropriate Capability

Low

• Confidence: 81% confidence
• Finding: The script writes to an arbitrary user-supplied output path after resolving it, with no restriction to a safe workspace or allowed directory. In an agent context, this can overwrite or create files outside the intended project area, which is more concerning because the skill's stated purpose does not require broad filesystem write access.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The readiness helper writes a project-level configuration file (.image-skills/<namespace>/EXTEND.md) outside the skill directory when certain conditions are met, without explicit user confirmation. For a skill described only as a chalk-art image generator, modifying caller project configuration expands scope beyond the stated purpose and can cause unexpected persistent changes in the host environment.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script automatically performs bootstrap actions whenever doctorSuite reports pending targets, and this occurs as part of an 'ensure ready' flow rather than a clearly separate install command. That behavior gives the skill environment-preparation and file-changing capabilities not implied by the manifest's narrow image-generation purpose, increasing the risk of unauthorized dependency or filesystem modifications.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: This block invokes bootstrapImpl on pending targets, enabling installation or environment preparation despite the skill being presented as a chalk-art image generator. In this context, setup and bootstrap behavior is not obviously necessary for fulfilling user image requests, so the mismatch makes the capability more suspicious and dangerous because it can alter the host project under the guise of content generation.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The CLI exposes `use_web_search`, which expands the trust boundary from local/user-provided prompts to externally retrieved web content. In a chalk-art skill, this capability is unnecessary and can cause unintended data disclosure or prompt contamination if user inputs are augmented with untrusted internet content.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The CLI accepts an arbitrary `webhook_url` and forwards it to the upstream service, enabling callbacks to attacker-controlled endpoints. In the context of a simple chalk-art generator, unsolicited outbound callbacks are unjustified and can be abused for data exfiltration, SSRF-style interactions via third-party infrastructure, or covert signaling.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script defines and ranks broad image-generation workflows such as cover, comic, article, infographic, and rednote, which materially exceeds the skill's declared chalk-art-only purpose. In an agent setting, this scope mismatch can cause the skill to be selected for unrelated image tasks and route prompts to models optimized for general generation rather than constrained chalkboard art, undermining policy boundaries and enabling capability creep.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: When no local registry is present, the script falls back to auto-discovering a general WeryAI image model list and then recommends from that broader set. This bypasses the implied specialization of the skill and can silently expand available generation capabilities beyond chalk art, especially because the fallback is automatic and presented as a normal operating mode.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The bundled model catalog exposes many general-purpose and photoreal, infographic, article, and comic-generation roles that are materially broader than the skill's declared chalk-art/chalkboard scope. If downstream selection logic trusts this catalog, the skill can be steered into generating off-scope content, weakening policy boundaries and enabling capability expansion beyond what users and reviewers expect.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The bootstrap script automatically runs `npm install` in every discovered directory containing a `package.json`, which executes arbitrary dependency lifecycle scripts and fetches untrusted code from the network. In a skill whose stated purpose is chalk-art image generation, this setup behavior is not necessary at runtime and materially increases supply-chain and code-execution risk if the tree contains unexpected manifests or compromised dependencies.

Context-Inappropriate Capability

Low

• Confidence: 85% confidence
• Finding: The recursive filesystem walk locates every `package.json` beneath the provided root and treats each as an installation target, broadening the trust boundary to all nested directories except a small skip list. This can cause unintended packages to be included in bootstrap operations, amplifying the risk of executing malicious or stray dependency trees if extra content is present in the repository or supplied root.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The script writes a new project-level configuration file under `.image-skills/<namespace>/EXTEND.md` based on the current project directory, even though the skill is described as a chalk-art image generator. This exceeds a narrow image-generation role and creates side effects in the caller's workspace without an explicit, narrowly scoped user action, which can surprise users and alter project behavior.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The readiness flow automatically invokes `bootstrapImpl` when pending targets are detected, meaning a check operation can trigger installation or setup behavior rather than only reporting status. In the context of a chalk-art skill, this is unnecessary privilege expansion and can modify the local environment in ways the user did not request.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The function inspects environment variables, home/project directories, and workflow state, then may perform local bootstrap actions based on that assessment. For a skill whose stated purpose is generating chalk art images, this broader environment inspection and remediation logic increases attack surface and creates a mismatch between advertised capability and actual system access.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill is marketed as a chalk-art generator, but the implementation exposes a broad set of generic image-generation styles and capabilities. This scope mismatch is dangerous because an agent or user relying on the manifest may unknowingly invoke more powerful behavior than intended, weakening least-privilege and policy enforcement.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The CLI supports text-to-image, image-to-image, batch submission, and status querying, which materially exceeds the narrow chalk-art description. Hidden extra capabilities increase attack surface and may let downstream agents perform actions outside the expected trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Enabling `use_web_search` gives an image-generation skill an undeclared external data-access capability. In this context, that can expand data exposure and unpredictably pull untrusted content into generation flows without users or policy layers expecting network search behavior.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Accepting an arbitrary `webhook_url` allows the tool to cause outbound callbacks to attacker-controlled endpoints through the upstream service. This can be abused for data exfiltration, network pivoting, or covert signaling, and it is especially risky because the skill is presented as only generating chalk art.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: This wrapper accepts an arbitrary entry-script argument and executes it through `npx ... bun`, which creates a general-purpose code execution path rather than a narrowly scoped image-generation helper. In the context of a chalk-art image generator, that flexibility is unnecessary and dangerous because any caller able to influence `entryArg` can run unintended local code, and the `npx -y bun` invocation also introduces execution of an externally resolved toolchain component.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the agent to persist an API key to a local `.env` file, but it does not require a clear user-facing warning about the security implications of storing a secret on disk. This can lead to accidental exposure through local file access, backups, source control, or later workspace sharing, especially because the agent is encouraged to handle the write on the user's behalf.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup flow tells the agent to silently create or overwrite workspace configuration files before informing the user. Hidden file modification is dangerous because it normalizes unauthorized state changes in the user's project and could be abused to introduce unexpected configuration, persistence, or supply-chain-relevant changes without meaningful user awareness.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code creates directories and writes EXTEND.md immediately when the file is absent and dry-run is false, with no warning, prompt, or confirmation. Silent persistent writes are dangerous in an agent skill because they can modify project behavior and configuration unexpectedly, and users invoking a chalk-art generator would not reasonably expect their repository settings to be changed.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: `fetchImageBytes` retries downloads with a Bearer token for whatever result URL is supplied, without verifying that the host is trusted. If an attacker can influence the returned image URL, the skill will send the API key to an arbitrary domain, directly exposing credentials.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/bootstrap.mjs:86

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/doctor.mjs:56

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/shared-image-generation/scripts/smoke-check.mjs:18

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/discover-models.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/doctor.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/main.ts:14

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/recommend-model.mjs:9

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/run-generate.mjs:23

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/vendor/weryai-image/setup.mjs:9

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/main.ts:47

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:51

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/main.ts:6

File read combined with network send (possible exfiltration).

Warn

• Code: suspicious.potential_exfiltration
• Location: scripts/vendor/shared-image-generation/scripts/main.ts:6