ClawHub
Back to skill

Security audit

Visual Note Card

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it automatically creates HTML that runs third-party JavaScript and renders it with Chromium sandboxing disabled.

Install only if you are comfortable with generated cards contacting Google Fonts and cdnjs when opened, and with the renderer running Chromium without its normal sandbox. Avoid feeding untrusted HTML into the PNG script, and review or remove the mandatory repository attribution if you need unbranded deliverables.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:174
Finding

Mandatory Third-Party Promotional Content Injected into User Deliverables

Content
View full analysis
Generated by https://github.com/beilunyang/visual-note-card-skills ``` ``` `assets/template.html:550-554`: ```html ``` ### Technical Analysis The Skill instructions require the agent to insert repository branding and an external hyperlink into every generated card. The placement inside the `.poster` element is explicitly selected so the promotional content is preserved in both the HTML and the exported PNG. This requirement is unrelated to the subject matter requested by the user and modifies the expected deliverables for the benefit of a third-party repository. Because the rule is marked mandatory, the loaded Skill alters the agent's output policy rather than treating attributi ...[truncated 902 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/html2png.py:42
Finding

Untrusted HTML Rendered with the Chromium Sandbox Disabled

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
assets/template.html:617
Finding

Remote JavaScript Dependency Loaded Without Integrity Verification

Content
View full analysis
``` `SKILL.md:164-166`: ```markdown Implementation: 1. Add `` before `` 2. The FAB (`div.fab-wrap`) is placed OUTSIDE `.poster` so it won't appear in the exported image ``` ### Technical Analysis The generated HTML executes `html2canvas` from a public CDN. Although the URL pins version `1.4.1`, the document does not use a Subresource Integrity hash and does not bundle a reviewed local copy. Consequently, the browser trusts whichever bytes the remote endpoint returns at runtime. This creates a supply-chain boundary outside the audited repository. Compromise of the CDN, its account, delivery path, or hosted asset could cause substituted JavaScript to execute whenever a generated card is opened. The dependency is also loaded when `html2png.py` navigates to the page, and that renderer currently disables Chromium sandboxing. ### Attack Path 1. The Skill generates an HTML card containing the CDN script reference. 2. A user opens the card, or `html2png.py` loads it for rendering. 3. The browser requests `html2canvas.min.js` from `cdnjs.cloudflare.com`. 4. If the remote asset or its delivery infrastructure has been compromised, the browser receives attacker-controlled JavaScript. 5. Because no integrity hash is present, the browser accepts and executes the substituted code. 6. In a normal browser, the code can manipulate the document and perform network requests within browser security constraints. In the headless workflow, a browser exploit would be more consequential because the Chromium sandbox is d ...[truncated 692 chars]
Remediation
View remediation
``` 4. Do not insert an unverified placeholder hash; generate and independently verify the correct hash before release. 5. Add a restrictive Content Security Policy that limits scripts and connections to explicitly approved sources. 6. Pin dependencies in a documented manifest and establish a controlled review process for upgrades. 7. Restrict or disable network access during server-side rendering so generated HTML cannot retrieve arbitrary runtime code. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (16)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Claude Code:

bash
rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

Claude Code:

bash
rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Claude Code:

bash
rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

OpenClaw:

bash
rm -rf ~/.openclaw/skills/visual-note-card

Usage

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill hard-codes that all text must be Chinese except limited elements, overriding the user's likely language preference unless they explicitly adapt it elsewhere. This creates a policy and UX risk because the system may produce output in an unsolicited language, mis-handle multilingual requests, and violate expected user-control over response language.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 1)May include surrounding context.

html
<!--
  VISUAL NOTE CARD TEMPLATE
  ==========================
  This is the canonical reference template. When generating a new card,

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 383)May include surrounding context.

html
<div class="label-right">{{SOURCE_LABEL}}</div>
  </div>

  <!-- ====== SECTION 2: MAIN TITLE ====== -->
  <div class="main-title">
    <div class="left">
      <h1>

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README states the skill generates professional Chinese visual note cards, which may steer output language toward Chinese without clear user opt-in. While not a classic security flaw, this can create misleading or undesired behavior, especially if the user input is in another language or if downstream consumers expect a different locale.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger condition is broad enough to activate on 'any request to summarize content into a structured visual card format,' which can cause the skill to run in situations the user did not explicitly intend. In an agentic environment, overly broad activation can lead to incorrect tool selection, unwanted transformations of user content, or accidental bypass of more appropriate workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger description is broad enough to activate on generic summarization, article condensation, and style-matching requests that may not actually require this skill. That can cause unintended tool use, creation of files/PNG exports when the user did not request them, and routing into a specialized workflow that changes output format and behavior unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The HTML root sets lang="zh-CN", which establishes a fixed locale for the generated artifact. Elsewhere in the template, interface strings such as export labels are also hard-coded in Chinese, indicating the skill is designed to operate in a specific language/locale without offering user choice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The template pulls Google Fonts from a third-party origin, which makes the generated infographic non-self-contained and causes network requests when opened. This leaks viewer metadata such as IP address and user agent to external services and can break rendering in offline or restricted environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The export controls and status text are presented only in Chinese, including labels like 导出图片 and 正在导出…. This is a natural-language policy issue because the skill imposes a single language on end users rather than offering localization or opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The export feature depends on a remotely loaded html2canvas script from a CDN, so the HTML file is not actually self-contained and executes third-party code at runtime. If the CDN is unavailable or the dependency is compromised, export fails or malicious script could run in the viewer's browser context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The module docstring and CLI help text are written entirely in Chinese, which imposes a specific language on users without any opt-in or indication that the tool is intentionally limited to a Chinese-speaking context. The policy explicitly calls for flagging language or locale constraints when no user choice or justification is provided.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script launches Chromium with both --no-sandbox and --disable-setuid-sandbox, removing an important defense boundary while rendering potentially untrusted local HTML. Because the skill converts user-supplied or generated HTML and waits for page activity to settle, any browser exploit or unsafe renderer behavior would run with fewer protections than normal, increasing host compromise risk.

Content

No source excerpt is available for this finding.