Visual Explainer

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:15 AM UTC
• Version: 1.0.0

Overview

The skill is a real visual HTML generator, but it should be reviewed carefully because it can read broad project context, write persistent reports, open browser-rendered HTML, use external services/scripts, and manage local servers/processes without tight safeguards.

Install only if you are comfortable with persistent local HTML reports, browser execution of generated pages, and broad project analysis. Avoid using it on private or sensitive repositories unless external generation is disabled, CDN scripts are removed or vendored, generated reports are reviewed before sharing, and server/cleanup scripts are not used on machines with important services on ports 8080-8089.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: prompts/diff-review.md:25
• Finding: Unrestricted Collection of Agent Memory and Conversation History<![CDATA[ ## Vulnerability Details **File Location**: `prompts/diff-review.md:25`, `prompts/project-recap.md:19-21` **Vulnerability Type**: Unauthorized access to persistent Agent context **Risk Level**: High ### Vulnerable Code ```markdown - Reconstruct decision rationale: if this work was done in the current session, mine the conversation for approaches discussed, alternatives rejected, and trade-offs made. Check for progress docs (`~/.agent/memory/{project}/progress.md`, `~/.pi/agent/memory/{project}/progress.md`) or plan files that may contain reasoning. For committed changes, read commit messages and PR descriptions. ``` ```markdown 3. **Current state.** Check for uncommitted changes (`git status`). Check for stale branches (`git branch --no-merged`). Look for TODO/FIXME comments in recently changed files. Read progress docs if they exist (`~/.agent/memory/{project}/progress.md`, `~/.pi/agent/memory/{project}/progress.md`, `.pi/todos/`, or similar). 4. **Decision context.** Read recent commit messages for rationale. If running in the same session as recent work, mine the conversation history. Read any plan docs, RFCs, or ADRs in the project directory. ``` ### Technical Analysis The review prompts direct the Agent to search persistent memory directories and mine current or previous conversation context. These sources may contain credentials, private discussions, unrelated project information, personal data, or instructions from other sessions. The access is automatic and is not limited to a user-selected progress document. The phrase “or similar” further broadens the search scope. Because the generated report is written to a persistent HTML file, sensitive context discovered during this process can be copied into a separate artifact. This behavior exceeds the minimum access required to visualize source-code differences or summarize repository activity. It violates least-privilege principles by treating Agent memory and conversation history as routine ...[truncated 974 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not inspect Agent memory or conversation history by default. - Require explicit, informed user approval before reading each external context source. - Restrict access to an exact user-supplied path rather than searching “similar” locations. - Display the files and conversation ranges that will be accessed before reading them. - Treat memory-derived content as sensitive and exclude it from generated reports unless the user explicitly approves inclusion. - Add secret and personal-data redaction before writing report artifacts. - Clearly distinguish repository-derived facts from conversation-derived or memory-derived rationale. ]]>

other

Warning

• Location: SKILL.md:91
• Finding: Project Context May Be Disclosed to an External Gemini Service< is available, you can generate images via Gemini and embed them in the page for creative, illustrative, explanatory, educational, or decorative purposes. Check availability with `which surf`. If available: ```bash # Generate to a temp file (use --aspect-ratio for control) surf gemini "descriptive prompt" --generate-image /tmp/ve-img.png --aspect-ratio 16:9 # Base64 encode for self-containment (macOS) IMG=$(base64 -i /tmp/ve-img.png) # Linux: IMG=$(base64 -w 0 /tmp/ve-img.png) # Embed in HTML and clean up # <img src="data:image/png;base64,${IMG}" alt="descriptive alt text"> rm /tmp/ve-img.png ``` ``` The slide guidance further states: ```markdown **surf-cli integration:** Check `which surf` at the start of every slide deck generation. If available, **generate 2–4 images minimum** for any deck over 10 slides. This is not optional when surf is available ``` ### Technical Analysis The Skill encourages the Agent to derive image-generation prompts from the project’s architecture, features, identity, changes, or planned system and submit those prompts through `surf gemini`. This creates an external data flow to a third-party AI service. Although image generation is described as optional in the main Skill, the slide-pattern instructions make it mandatory for decks over ten slides whenever `surf` is installed. There is no required confidentiality classification, content redaction, exact-prompt preview, or user approval before transmission. The image returned by the service is embedded locally as Base64, but that does not mitigate ...[truncated 827 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make all external image generation explicitly opt-in. - Before invoking `surf`, show the exact provider, command, and prompt to the user for approval. - Default to CSS, SVG, or locally generated imagery for private repositories. - Add a sensitive-data review that removes repository names, hostnames, customer data, internal service names, secrets, and unreleased feature details. - Do not make external generation mandatory merely because the executable is installed. - Document the external provider’s data-retention and privacy implications. - Offer a configuration such as `external_generation: disabled` and honor it throughout every prompt and reference document. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: templates/mermaid-flowchart.html:342
• Finding: Generated Reports Execute Mutable JavaScript from External CDNs<![CDATA[ ## Vulnerability Details **File Location**: `references/libraries.md:14-24`, `templates/mermaid-flowchart.html:342-343`, `templates/slide-deck.html:798`, `services-dependency-mapping.html:697` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```javascript import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs'; import elkLayouts from 'https://cdn.jsdelivr.net/npm/@mermaid-js/layout-elk/dist/mermaid-layout-elk.esm.min.mjs'; ``` Additional recommended dependencies include: ```html <script src="https://cdn.jsdelivr.net/npm/chart.js@4/dist/chart.umd.min.js"></script> <script src="https://cdn.jsdelivr.net/npm/animejs@3.2.2/lib/anime.min.js"></script> ``` ### Technical Analysis The templates and library guidance load executable JavaScript directly from jsDelivr. Mermaid, Chart.js, and the ELK layout package use mutable major-version selectors such as `@11` and `@4`. The effective code executed by a previously reviewed HTML report can therefore change when the CDN resolves those URLs to newer releases. The module imports have no Subresource Integrity protection. Even where an exact version is used, as with anime.js, no integrity hash is provided. A compromised CDN, compromised upstream package, account takeover, or malicious future package release could introduce code that executes automatically when a report is opened. This matches remote payload retrieval because the reviewed project does not contain the complete executable dependency payload. ### Attack Path 1. The Agent generates a report containing one or more documented CDN imports. 2. The user opens the report in a browser while connected to the network. 3. The browser retrieves JavaScript from jsDelivr. 4. The CDN or resolved package version supplies compromised code. 5. The browser executes that code in the report’s page context. ### Impact Assessment Compromised JavaScript can read and modify the report ...[truncated 296 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Vendor reviewed JavaScript dependencies into the package and load them locally. - Pin every dependency to an exact immutable version; do not use major-version selectors such as `@11` or `@4`. - Where classic scripts remain external, add verified Subresource Integrity hashes and `crossorigin="anonymous"`. - Apply a restrictive Content Security Policy that permits scripts only from explicitly approved locations. - For ES modules where SRI support is unsuitable, use locally bundled modules or immutable content-addressed URLs. - Maintain a dependency lock file and periodically scan vendored dependencies for known vulnerabilities. - Provide a static CSS/SVG fallback so reports remain usable without remote scripts. ]]>

T08 · Insecure Dependencies

Error

• Location: commands/_visual-explainer-serve.md:36
• Finding: Unpinned Package Download and Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `commands/_visual-explainer-serve.md:36-40`, `SERVING.md:75` **Vulnerability Type**: Unsafe runtime dependency execution **Risk Level**: High ### Vulnerable Code ```markdown ## Alternative: Node.js (if Python not available) ```bash cd visual-explainer/templates npx serve . ``` ``` ### Technical Analysis Running `npx serve .` may download the latest matching `serve` package and execute it immediately if it is not already available locally. The command does not specify an exact reviewed version and the project has no lock file or declared dependency for this utility. As a result, the package executed at runtime can differ from the package reviewed with the Skill. Package-registry compromise, maintainer account takeover, a malicious future release, or local npm configuration manipulation could cause arbitrary code execution under the invoking user account. ### Attack Path 1. A user follows the documented Node.js serving alternative. 2. `npx` resolves `serve` using the configured npm registry and local cache. 3. If necessary, `npx` downloads an unpinned package version. 4. npm lifecycle or package runtime code executes locally. 5. A compromised package gains the permissions of the user who invoked the command. ### Impact Assessment A malicious package could read or modify files available to the current user, inspect environment variables, access network resources, alter generated reports, or establish additional processes. The command does not request administrator privileges, so its default scope is the invoking user’s permissions. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer the existing Python standard-library server and remove the `npx` alternative. - If Node.js support is required, declare an exact reviewed version in `package.json` and commit a lock file. - Invoke the local binary rather than allowing `npx` to resolve and download an arbitrary version. - Use `npx --offline --no-install` or an equivalent policy that refuses network installation. - Configure an approved registry and verify package provenance and integrity. - Document the selected version and include dependency-scanning updates in the maintenance process. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/clean-server.sh:10
• Finding: Cleanup Scripts Can Terminate Unrelated Processes by Port Number<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clean-server.sh:10-16`, `scripts/stop-server.sh:21-29`, `commands/_visual-explainer-serve.md:43-46` **Vulnerability Type**: Unscoped process termination **Risk Level**: Medium ### Vulnerable Code ```bash # Kill all Python HTTP servers for PORT in 8080 8081 8082 8083 8084 8085 8086 8087 8088 8089; do PID=$(lsof -ti:$PORT 2>/dev/null) if [ -n "$PID" ]; then kill $PID 2>/dev/null fi done ``` ```bash # If port file approach failed, search for any Python HTTP server PYTHON_SERVICES=$(lsof -ti:8080,8081,8082,8083,8084,8085,8086,8087,8088,8089) if [ -n "$PYTHON_SERVICES" ]; then echo "📍 Found Python HTTP services (pids: $PYTHON_SERVICES)" for PID in $PYTHON_SERVICES; do kill $PID done echo "✅ All Python HTTP servers stopped" fi ``` The documentation also recommends: ```bash lsof -ti:8080|xargs kill -9 ``` ### Technical Analysis The scripts infer process ownership solely from the port being used. They do not verify that the resolved PID belongs to a server created by this Skill, that it is a Python HTTP server, or that its command line and working directory match the expected process. The fallback in `stop-server.sh` is especially broad: despite its comment, `lsof -ti` returns any process using the selected ports. The documented `kill -9` command is more destructive because it prevents graceful shutdown and cleanup. ### Attack Path 1. An unrelated application or development server listens on a port from 8080 through 8089. 2. The user runs `clean-server.sh`, `stop-server.sh`, or the documented troubleshooting command. 3. `lsof` resolves the unrelated process ID. 4. The script sends a termination signal to that process. 5. The unrelated service stops and may lose unsaved or in-flight data. ### Impact Assessment The scripts can terminate any same-user process on the selected ports and, if run with elevated privileges, potentially processes belonging to o ...[truncated 148 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Save both the PID and a process identity marker when starting the server. - Before termination, verify the PID’s executable, command line, working directory, parent process, and expected port. - Use a PID file created atomically with restrictive permissions. - Confirm that the PID has not been reused since the file was written. - Remove the fallback that terminates every process on ports 8080–8089. - Use graceful `SIGTERM`, wait for shutdown, and reserve `SIGKILL` for an explicitly confirmed final fallback. - Prompt the user before terminating any process whose identity cannot be verified. - Never recommend running these cleanup commands with `sudo`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/serve-report.sh:17
• Finding: Report Servers Listen on All Network Interfaces by Default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/serve-report.sh:17`, `scripts/serve-report-alt-port.sh:17`, `scripts/serve-report-best-port.sh:28-30`, `scripts/serve-report-auto.sh:24-26,60-62` **Vulnerability Type**: Unauthenticated network exposure **Risk Level**: Medium ### Vulnerable Code ```bash cd "$(dirname "$0")/.." && python3 -m http.server $PORT --directory templates ``` ```bash # Start server in background cd "$(dirname "$0")/.." && python3 -m http.server $FOUND_PORT --directory templates & SERVER_PID=$! ``` ```bash # Use nohup for more stable background execution nohup python3 -m http.server $FOUND_PORT --directory templates > /tmp/visual-explainer-server-$FOUND_PORT.log 2>&1 & SERVER_PID=$! ``` ### Technical Analysis `python3 -m http.server` binds to all interfaces unless a bind address is supplied. The scripts therefore expose the selected directory to reachable network peers by default rather than limiting access to localhost. The server provides no authentication, authorization, TLS, or access logging controls beyond Python’s basic development server behavior. Other project instructions encourage reports to contain source-code analysis, project history, Agent memory-derived context, and implementation details. Although these scripts currently specify the `templates` directory, future or modified usage can expose generated or sensitive reports in the same manner. The `nohup` variant can continue running after the launching shell exits, increasing the window of exposure. ### Attack Path 1. A user starts a report server using one of the supplied scripts. 2. Python binds the server to all network interfaces on the selected port. 3. Another host on the same reachable network discovers or learns the port. 4. The remote host requests files from the served directory without authentication. 5. Available templates or reports are disclosed; the server may remain available until explicitly stopped. ### Impact Assessment Any network ...[truncated 416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind to localhost by default: ```bash python3 -m http.server "$PORT" --bind 127.0.0.1 --directory templates ``` - Require an explicit `--network` option before binding to non-loopback interfaces. - Display a clear warning and request confirmation before network exposure. - Restrict the served directory to the exact intended output files. - Avoid serving reports that contain memory, conversation, proprietary, or secret material without a redaction review. - For intentional sharing, use an authenticated server with TLS and an allowlist rather than Python’s development server. - Store and validate the server PID, provide reliable shutdown, and avoid `nohup` unless persistence has been explicitly requested. - Add a startup message that prints the actual bind address instead of only example LAN URLs. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (100)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill creates styled HTML pages for visual explanations of technical content. The actual code does not generate HTML or any visual output. Instead, it performs system cleanup actions: removing a saved port file and killing processes bound to ports 8080 through 8089. These are materially different capabilities and involve local file/process manipulation that is undeclared in the description. This is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says the skill generates self-contained HTML pages for visual explanations. The provided code does not generate HTML or explain technical concepts; instead, it operationally serves existing files via a Python HTTP server. While hosting generated HTML could be a supporting function in a broader visual-explainer tool, this specific code chunk's primary behavior is server orchestration and port selection, which is materially different from the declared end-user purpose. It also performs undeclared capabilities such as network service exposure, filesystem writes, process management, and port inspection. Therefore this code chunk does not accurately match the declared description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is content generation: producing styled HTML pages that visually explain technical information. The actual code chunk does not generate or render any HTML at all. Instead, it performs operational hosting tasks: finding an open port, persisting that port number, starting a Python web server, and advertising local/network URLs. Serving previously generated reports could be a supporting deployment detail, but as a standalone code chunk its primary behavior is network service orchestration, which is materially different from the declared purpose and includes undeclared capabilities such as port scanning and server startup.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this skill generates styled HTML visual explanations for technical content. The actual code does not generate HTML, render diagrams, explain systems, or format data visually. Instead, it performs operational server-management actions: locating local processes, terminating them, and removing a tracking file. This is a materially different primary purpose and includes undeclared capabilities that affect local system processes and files. Therefore, the description does not accurately represent the code's behavior.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Embed in HTML and clean up
# <img src="data:image/png;base64,${IMG}" alt="descriptive alt text">
rm /tmp/ve-img.png
```

See `./references/css-patterns.md` for image container styles (hero banners, inline illustrations, captions).

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

To completely remove saved port and PID:

```bash
rm visual-explainer/scripts/server-port.txt
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The prompt materially exceeds the stated purpose of the visual-explainer skill. Instead of generating visual HTML explanations, it instructs the agent to inspect arbitrary files, query git history, validate claims against the codebase, and rewrite documents in place, which creates a capability mismatch that can be used to smuggle broad repo-analysis and editing powers through an unrelated skill.

Hidden Instructions

High

• Category: Prompt Injection

Content

```html
<svg class="connectors" style="position:absolute;inset:0;width:100%;height:100%;pointer-events:none;">
  <path d="M 150,100 C 150,200 350,100 350,200" fill="none" stroke="var(--accent)" stroke-width="1.5" stroke-dasharray="4 3"/>
  <!-- Arrowhead -->
  <polygon points="348,195 352,205 356,195" fill="var(--accent)"/>
</svg>
```

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<section class="slide slide--title"> ... </section>
  <section class="slide slide--content"> ... </section>
  <section class="slide slide--diagram"> ... </section>
  <!-- one <section> per slide -->
</div>
</body>
```

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</ul>
    </div>
    <div class="slide__aside reveal">
      <!-- optional: illustration, icon, mini-diagram, accent SVG -->
    </div>
  </div>
</section>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# <div class="slide__bg" style="background-image:url('data:image/png;base64,${TITLE_IMG}')"></div>

# Clean up
rm /tmp/ve-slide-title.png
```

**Prompt craft for slides:** Be specific about style, dominant colors, and mood. Pull colors from the preset's CSS variables. Examples:

• Confidence: 93% confidence
• Finding: The explicit cleanup command `rm /tmp/ve-slide-title.png` normalizes shell-based file deletion as part of the skill workflow. Even though the example path is fixed, embedding destructive shell operations in a content-generation skill conditions the agent toward unnecessary filesystem modification and becomes more dangerous if later generalized with variable paths or prompt-derived filenames.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script deletes a local state file and kills processes, but the skill metadata describes only generation of self-contained visual HTML explanations. This undeclared operational behavior broadens the skill's capabilities beyond user expectations and creates risk of unauthorized local interference, especially because the actions are destructive and not obviously tied to rendering HTML.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The script enumerates fixed local ports and forcefully kills any process bound to them, regardless of ownership or whether the process belongs to this skill. In a visual HTML explainer skill, that capability is unrelated to the declared purpose and can disrupt other developer workflows or local services, making the mismatch especially suspicious and dangerous.

Hidden Instructions

High

• Category: Prompt Injection

Content

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Service Dependency Mapping — Reference Template</title>
<!--
  Reference template for the visual-explainer skill: service dependency mapping.
  Terracotta/salmon palette — distinctly different from teal (mermaid)
  and rose (data-table) templates so agents absorb variety.

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </div>

  <!-- Mermaid Network Graph -->
  <div class="diagram-section animate" style="--i:4">
    <div class="diagram-label">Dependency Network</div>
    <div class="mermaid-wrap">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Architecture Diagram — Reference Template</title>
<!--
  Reference template for the visual-explainer skill: CSS Grid architecture layout.
  Warm terracotta/sage palette — distinctly different from the teal (mermaid)
  and rose (data-table) templates so agents absorb variety, not a single palette.

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>CI/CD Pipeline — Reference Template</title>
<!--
  Reference template for the visual-explainer skill: Mermaid diagrams.
  Teal/cyan palette — distinctly different from terracotta (architecture)
  and rose (data-table) templates so agents absorb variety.

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>API Gateway Redesign — Reference Slide Deck</title>
<!--
  Reference template for the visual-explainer skill: slide decks.
  Midnight Editorial preset — deep navy, serif display, warm gold accents.
  Distinctly different from the terracotta (architecture), teal (mermaid),

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</div>
  </section>

  <!-- SLIDE 7: DASHBOARD -->
  <section class="slide slide--dashboard" style="background-image:radial-gradient(ellipse at 70% 30%, var(--accent-dim) 0%, transparent 40%);">
    <h2 class="slide__heading reveal">Performance Impact</h2>
    <div class="slide__kpis">

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<cite class="reveal">&mdash; Edge Computing Principle</cite>
  </section>

  <!-- SLIDE 11: FULL-BLEED -->
  <section class="slide slide--bleed">
    <div class="slide__bg slide__bg--gradient"></div>
    <div class="slide__scrim"></div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The page imports Mermaid as a live ES module from jsDelivr at runtime, so simply viewing the deck executes third-party code from the network. This breaks the self-contained guarantee and introduces both privacy exposure and a direct supply-chain risk because compromised or changed CDN content would run in the viewer's browser.

Hidden Instructions

High

• Category: Prompt Injection

Content

A <code>visual-explainer</code> agent skill that transforms complex terminal output into styled HTML pages. <strong>Replaces ASCII art</strong> and box-drawing tables with professional diagrams, interactive Mermaid charts, and readable typography.
  </p>

  <!-- Overview Diagram -->
  <div class="mermaid-wrap animate" style="--i:3">
    <div class="zoom-controls">
      <button onclick="zoomDiagram(this, 1.2)" title="Zoom in">+</button>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly says the skill generates a self-contained HTML page and opens it in the browser, but it does not warn users that local file creation and browser execution-like rendering will occur. Even if intended for visualization, opening generated HTML can expose users to script execution, external resource loading, or deceptive rendered content if the generated page includes unsafe dynamic content.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Claude Code:**
```bash
git clone https://github.com/nicobailon/visual-explainer.git ~/.claude/skills/visual-explainer
mkdir -p ~/.claude/commands
cp ~/.claude/skills/visual-explainer/prompts/*.md ~/.claude/commands/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The README states the skill activates automatically when an agent is about to emit a complex table, which is a broad trigger that can fire during routine work without an explicit user request. In the context of a skill that writes HTML files and opens them in a browser, this increases the chance of unprompted file creation and browser launching, expanding the action surface beyond clearly user-initiated operations.

Static analysis

No suspicious patterns detected.