T05 · Unauthorized Access and Privilege Escalation
Error
- Location
prompts/diff-review.md:25- Finding
Unrestricted Collection of Agent Memory and Conversation History
- Content
View full analysis
- Remediation
View remediation
Security audit
Visual Explainer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a real visual HTML generator, but it should be reviewed carefully because it can read broad project context, write persistent reports, open browser-rendered HTML, use external services/scripts, and manage local servers/processes without tight safeguards.
Install only if you are comfortable with persistent local HTML reports, browser execution of generated pages, and broad project analysis. Avoid using it on private or sensitive repositories unless external generation is disabled, CDN scripts are removed or vendored, generated reports are reviewed before sharing, and server/cleanup scripts are not used on machines with important services on ports 8080-8089.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)
other
Warning
- Location
SKILL.md:91- Finding
Project Context May Be Disclosed to an External Gemini Service
- Content
View full analysis
rm /tmp/ve-img.png ``` ``` The slide guidance further states: ```markdown **surf-cli integration:** Check `which surf` at the start of every slide deck generation. If available, **generate 2–4 images minimum** for any deck over 10 slides. This is not optional when surf is available ``` ### Technical Analysis The Skill encourages the Agent to derive image-generation prompts from the project’s architecture, features, identity, changes, or planned system and submit those prompts through `surf gemini`. This creates an external data flow to a third-party AI service. Although image generation is described as optional in the main Skill, the slide-pattern instructions make it mandatory for decks over ten slides whenever `surf` is installed. There is no required confidentiality classification, content redaction, exact-prompt preview, or user approval before transmission. The image returned by the service is embedded locally as Base64, but that does not mitigate ...[truncated 827 chars]- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
templates/mermaid-flowchart.html:342- Finding
Generated Reports Execute Mutable JavaScript from External CDNs
- Content
View full analysis
``` ### Technical Analysis The templates and library guidance load executable JavaScript directly from jsDelivr. Mermaid, Chart.js, and the ELK layout package use mutable major-version selectors such as `@11` and `@4`. The effective code executed by a previously reviewed HTML report can therefore change when the CDN resolves those URLs to newer releases. The module imports have no Subresource Integrity protection. Even where an exact version is used, as with anime.js, no integrity hash is provided. A compromised CDN, compromised upstream package, account takeover, or malicious future package release could introduce code that executes automatically when a report is opened. This matches remote payload retrieval because the reviewed project does not contain the complete executable dependency payload. ### Attack Path 1. The Agent generates a report containing one or more documented CDN imports. 2. The user opens the report in a browser while connected to the network. 3. The browser retrieves JavaScript from jsDelivr. 4. The CDN or resolved package version supplies compromised code. 5. The browser executes that code in the report’s page context. ### Impact Assessment Compromised JavaScript can read and modify the report ...[truncated 296 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
commands/_visual-explainer-serve.md:36- Finding
Unpinned Package Download and Execution Through npx
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/clean-server.sh:10- Finding
Cleanup Scripts Can Terminate Unrelated Processes by Port Number
- Content
View full analysis
/dev/null) if [ -n "$PID" ]; then kill $PID 2>/dev/null fi done ``` ```bash # If port file approach failed, search for any Python HTTP server PYTHON_SERVICES=$(lsof -ti:8080,8081,8082,8083,8084,8085,8086,8087,8088,8089) if [ -n "$PYTHON_SERVICES" ]; then echo "📍 Found Python HTTP services (pids: $PYTHON_SERVICES)" for PID in $PYTHON_SERVICES; do kill $PID done echo "✅ All Python HTTP servers stopped" fi ``` The documentation also recommends: ```bash lsof -ti:8080|xargs kill -9 ``` ### Technical Analysis The scripts infer process ownership solely from the port being used. They do not verify that the resolved PID belongs to a server created by this Skill, that it is a Python HTTP server, or that its command line and working directory match the expected process. The fallback in `stop-server.sh` is especially broad: despite its comment, `lsof -ti` returns any process using the selected ports. The documented `kill -9` command is more destructive because it prevents graceful shutdown and cleanup. ### Attack Path 1. An unrelated application or development server listens on a port from 8080 through 8089. 2. The user runs `clean-server.sh`, `stop-server.sh`, or the documented troubleshooting command. 3. `lsof` resolves the unrelated process ID. 4. The script sends a termination signal to that process. 5. The unrelated service stops and may lose unsaved or in-flight data. ### Impact Assessment The scripts can terminate any same-user process on the selected ports and, if run with elevated privileges, potentially processes belonging to o ...[truncated 148 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/serve-report.sh:17- Finding
Report Servers Listen on All Network Interfaces by Default
- Content
View full analysis
/tmp/visual-explainer-server-$FOUND_PORT.log 2>&1 & SERVER_PID=$! ``` ### Technical Analysis `python3 -m http.server` binds to all interfaces unless a bind address is supplied. The scripts therefore expose the selected directory to reachable network peers by default rather than limiting access to localhost. The server provides no authentication, authorization, TLS, or access logging controls beyond Python’s basic development server behavior. Other project instructions encourage reports to contain source-code analysis, project history, Agent memory-derived context, and implementation details. Although these scripts currently specify the `templates` directory, future or modified usage can expose generated or sensitive reports in the same manner. The `nohup` variant can continue running after the launching shell exits, increasing the window of exposure. ### Attack Path 1. A user starts a report server using one of the supplied scripts. 2. Python binds the server to all network interfaces on the selected port. 3. Another host on the same reachable network discovers or learns the port. 4. The remote host requests files from the served directory without authentication. 5. Available templates or reports are disclosed; the server may remain available until explicitly stopped. ### Impact Assessment Any network ...[truncated 416 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (100)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill creates styled HTML pages for visual explanations of technical content. The actual code does not generate HTML or any visual output. Instead, it performs system cleanup actions: removing a saved port file and killing processes bound to ports 8080 through 8089. These are materially different capabilities and involve local file/process manipulation that is undeclared in the description. This is a clear description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description says the skill generates self-contained HTML pages for visual explanations. The provided code does not generate HTML or explain technical concepts; instead, it operationally serves existing files via a Python HTTP server. While hosting generated HTML could be a supporting function in a broader visual-explainer tool, this specific code chunk's primary behavior is server orchestration and port selection, which is materially different from the declared end-user purpose. It also performs undeclared capabilities such as network service exposure, filesystem writes, process management, and port inspection. Therefore this code chunk does not accurately match the declared description.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is content generation: producing styled HTML pages that visually explain technical information. The actual code chunk does not generate or render any HTML at all. Instead, it performs operational hosting tasks: finding an open port, persisting that port number, starting a Python web server, and advertising local/network URLs. Serving previously generated reports could be a supporting deployment detail, but as a standalone code chunk its primary behavior is network service orchestration, which is materially different from the declared purpose and includes undeclared capabilities such as port scanning and server startup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description says this skill generates styled HTML visual explanations for technical content. The actual code does not generate HTML, render diagrams, explain systems, or format data visually. Instead, it performs operational server-management actions: locating local processes, terminating them, and removing a tracking file. This is a materially different primary purpose and includes undeclared capabilities that affect local system processes and files. Therefore, the description does not accurately represent the code's behavior.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Embed in HTML and clean up
rm /tmp/ve-img.png
text See `./references/css-patterns.md` for image container styles (hero banners, inline illustrations, captions).
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
To completely remove saved port and PID:
bash rm visual-explainer/scripts/server-port.txt
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prompt materially exceeds the stated purpose of the visual-explainer skill. Instead of generating visual HTML explanations, it instructs the agent to inspect arbitrary files, query git history, validate claims against the codebase, and rewrite documents in place, which creates a capability mismatch that can be used to smuggle broad repo-analysis and editing powers through an unrelated skill.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <svg class="connectors" style="position:absolute;inset:0;width:100%;height:100%;pointer-events:none;"> <path d="M 150,100 C 150,200 350,100 350,200" fill="none" stroke="var(--accent)" stroke-width="1.5" stroke-dasharray="4 3"/> <!-- Arrowhead --> <polygon points="348,195 352,205 356,195" fill="var(--accent)"/> </svg>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
... ... ... ```
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </ul> </div> <div class="slide__aside reveal"> <!-- optional: illustration, icon, mini-diagram, accent SVG --> </div> </div> </section>
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The explicit cleanup command
rm /tmp/ve-slide-title.pngnormalizes shell-based file deletion as part of the skill workflow. Even though the example path is fixed, embedding destructive shell operations in a content-generation skill conditions the agent toward unnecessary filesystem modification and becomes more dangerous if later generalized with variable paths or prompt-derived filenames.- Content
Clean up
rm /tmp/ve-slide-title.png
text **Prompt craft for slides:** Be specific about style, dominant colors, and mood. Pull colors from the preset's CSS variables. Examples:
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script deletes a local state file and kills processes, but the skill metadata describes only generation of self-contained visual HTML explanations. This undeclared operational behavior broadens the skill's capabilities beyond user expectations and creates risk of unauthorized local interference, especially because the actions are destructive and not obviously tied to rendering HTML.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script enumerates fixed local ports and forcefully kills any process bound to them, regardless of ownership or whether the process belongs to this skill. In a visual HTML explainer skill, that capability is unrelated to the declared purpose and can disrupt other developer workflows or local services, making the mismatch especially suspicious and dangerous.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Service Dependency Mapping — Reference Template</title> <!-- Reference template for the visual-explainer skill: service dependency mapping. Terracotta/salmon palette — distinctly different from teal (mermaid) and rose (data-table) templates so agents absorb variety.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </div> <!-- Mermaid Network Graph --> <div class="diagram-section animate" style="--i:4"> <div class="diagram-label">Dependency Network</div> <div class="mermaid-wrap">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Architecture Diagram — Reference Template</title> <!-- Reference template for the visual-explainer skill: CSS Grid architecture layout. Warm terracotta/sage palette — distinctly different from the teal (mermaid) and rose (data-table) templates so agents absorb variety, not a single palette.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>CI/CD Pipeline — Reference Template</title> <!-- Reference template for the visual-explainer skill: Mermaid diagrams. Teal/cyan palette — distinctly different from terracotta (architecture) and rose (data-table) templates so agents absorb variety.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>API Gateway Redesign — Reference Slide Deck</title> <!-- Reference template for the visual-explainer skill: slide decks. Midnight Editorial preset — deep navy, serif display, warm gold accents. Distinctly different from the terracotta (architecture), teal (mermaid),
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </div> </section> <!-- SLIDE 7: DASHBOARD --> <section class="slide slide--dashboard" style="background-image:radial-gradient(ellipse at 70% 30%, var(--accent-dim) 0%, transparent 40%);"> <h2 class="slide__heading reveal">Performance Impact</h2> <div class="slide__kpis">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <cite class="reveal">— Edge Computing Principle</cite> </section> <!-- SLIDE 11: FULL-BLEED --> <section class="slide slide--bleed"> <div class="slide__bg slide__bg--gradient"></div> <div class="slide__scrim"></div>
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The page imports Mermaid as a live ES module from jsDelivr at runtime, so simply viewing the deck executes third-party code from the network. This breaks the self-contained guarantee and introduces both privacy exposure and a direct supply-chain risk because compromised or changed CDN content would run in the viewer's browser.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html A <code>visual-explainer</code> agent skill that transforms complex terminal output into styled HTML pages. <strong>Replaces ASCII art</strong> and box-drawing tables with professional diagrams, interactive Mermaid charts, and readable typography. </p> <!-- Overview Diagram --> <div class="mermaid-wrap animate" style="--i:3"> <div class="zoom-controls"> <button onclick="zoomDiagram(this, 1.2)" title="Zoom in">+</button>
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly says the skill generates a self-contained HTML page and opens it in the browser, but it does not warn users that local file creation and browser execution-like rendering will occur. Even if intended for visualization, opening generated HTML can expose users to script execution, external resource loading, or deceptive rendered content if the generated page includes unsafe dynamic content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Claude Code:
bash git clone https://github.com/nicobailon/visual-explainer.git ~/.claude/skills/visual-explainer mkdir -p ~/.claude/commands cp ~/.claude/skills/visual-explainer/prompts/*.md ~/.claude/commands/
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README states the skill activates automatically when an agent is about to emit a complex table, which is a broad trigger that can fire during routine work without an explicit user request. In the context of a skill that writes HTML files and opens them in a browser, this increases the chance of unprompted file creation and browser launching, expanding the action surface beyond clearly user-initiated operations.
- Content