T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:6- Finding
Adult-content filter inversion and missing response validation
- Content
View full analysis
- Remediation
View remediation
Security audit
sages-stash
Security checks for vulnerabilities and agentic risk
Overview
This skill is a Review item because it claims to return non-adult images but instructs the agent to request likely R18 content from a third-party image API without validating the result.
Install only if you are comfortable with a skill that contacts a third-party image API for NSFW-adjacent prompts and may return adult or untrusted image links despite saying it returns non-R18 content. The publisher should clarify the content policy, narrow the triggers, validate r18=false, and structurally validate returned URLs before this is treated as low-risk.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:50- Finding
Untrusted image URL is returned without structural origin validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill documentation materially contradicts itself: it claims to return a non-R18 'surprise' image, but the API example uses r18=1, which typically requests adult content. In a skill explicitly triggered by NSFW-related prompts, this ambiguity can cause the agent to fetch or return content that violates user expectations, policy boundaries, or safety controls.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger definition is overly broad, includes many generic sexualized terms, and ends with an open-ended 'etc.', which makes invocation scope unpredictable. That ambiguity increases the chance the skill activates unintentionally and performs third-party retrieval of sensitive or adult-themed content in contexts where the user did not clearly consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs the agent to make a live request to a third-party image API and return third-party-hosted content, but it does not clearly disclose that network transmission and remote content sourcing to the user. In a sensitive NSFW-adjacent context, lack of transparency around external calls and unvetted content sources increases privacy, trust, and safety risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
This skill performs an external network request to api.lolicon.app to retrieve image metadata/URLs, which constitutes data egress and introduces dependency on an untrusted third-party content source. Even if no obvious secrets are sent here, external retrieval in an adult-content-triggered skill can expose user intent and return unsafe or policy-violating material.
- Content
Use curl to call the API:
bash # r18=1 is required for filtering curl -s "https://api.lolicon.app/setu/v2?num=1&r18=1&size=original"Parameters
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This JSON file contains example prompts such as "来张色图" and "来点刺激的" that are broad, colloquial phrases without clear scope or exclusion conditions. In a manifest-like eval file, such vague trigger examples can imply activation on everyday speech and do not define when the skill should or should not respond.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instructions conflict on which field to extract from the API response: one line says to return content inside data[number].url, while the schema and processing steps reference data[number].urls.original. This mismatch can lead to incorrect parsing, broken output handling, or unsafe fallback logic if an agent tries to guess alternate fields from untrusted API responses.
- Content
Static analysis
No suspicious patterns detected.