视觉系幻灯片捕手 (The Slide Sniper)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:01 AM UTC
• Version: 0.1.0

Overview

The skill's slide-note behavior is mostly clear, but it requests unexplained network access while monitoring and screenshotting the user's screen.

Review this before installing if your screen may show private meetings, chats, documents, or credentials. The skill should ideally disable network access or clearly explain where screenshots/OCR text may go, and it should ask for confirmation and provide a clear stop command before monitoring starts.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:12

Finding

Unnecessary Unrestricted Network Permission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-13
Vulnerability Type: Excessive network permission
Risk Level: Medium

Vulnerable Configuration:

yaml

network:
  allowed: true

Technical Analysis

The skill requests unrestricted network access even though its documented workflow only requires local operations: monitoring the screen, capturing slide images, performing OCR, and writing notes under ~/Documents/Notes/SlideSniper.

No network destination, protocol, or network-dependent feature is documented. The permission therefore violates the principle of least privilege by granting a capability beyond the skill's stated operational requirements. Because the skill processes screenshots and extracted screen text, misuse of this capability could create an exfiltration channel for potentially sensitive visual information.

The reviewed file does not contain an instruction to transmit data, an external endpoint, or executable code that performs exfiltration. Exploitation would consequently require malicious or compromised runtime instructions, implementation logic, or execution context to misuse the granted permission.

Attack Path

1. A user activates the slide-monitoring functionality.
2. The skill captures video frames and extracts text from the displayed slides.
3. Sensitive information may enter the skill's processing context through screenshots or OCR output.
4. Malicious or compromised runtime logic takes advantage of the unrestricted network permission.
5. The captured images or extracted text are transmitted to an attacker-controlled destination without requiring an additional network authorization boundary.

Impact Assessment

Successful exploitation could expose slide screenshots, OCR text, course materials, meeting content, or other information inadvertently visible within the monitored screen region. The permission does not itself provide shell execution, filesystem ...[truncated 161 chars]

Remediation

View remediation

Remediation Suggestions

Disable network access because the documented functionality is local:

yaml

network:
  allowed: false

If a future feature legitimately requires network connectivity:

1. Allow only explicitly documented and trusted destinations.
2. Restrict permitted protocols, ports, and request types.
3. Require informed user consent before transmitting screenshots or OCR output.
4. Minimize or redact captured data before transmission.
5. Prevent access to private, loopback, link-local, and cloud metadata addresses.
6. Record visible audit logs describing what data was transmitted and where.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill performs continuous background screen observation, screenshot capture, OCR extraction, and local file creation while also declaring network access, but it does not prominently warn the user about these sensitive actions. This creates a substantial privacy and consent risk because users may not realize that screen contents beyond the intended slide area could be captured or transmitted during processing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The operational instructions, trigger phrases, extracted note templates, and safety guidance are all specified in Chinese, which can impose a language/locale requirement on users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrase is broad enough that it could be activated during ordinary conversation about watching a livestream or taking notes, rather than through a clearly intentional opt-in. In this skill, accidental activation is especially risky because the behavior starts background screen monitoring, periodic screenshot capture, OCR, and note creation without an additional confirmation step.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.