ClawHub
Back to skill

Security audit

zhz-picture-story-book

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent picture-story workflow that uses local scripts to compose pages and PDFs, with no evidence of hidden persistence, credential access, or destructive behavior.

Before installing, be aware that the skill may install Pillow with pip, relies on a separate local zhz-image-gen backend for actual image generation, and writes generated story files, images, logs, and PDFs into the working project directory. Review generated prompts and storyboards before allowing image generation if the content matters.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a content-generation skill for creating illustrated storybooks/comics, including one image per page, bottom text descriptions, and multiple visual styles. The actual code only performs post-processing: it locates image files in a directory and combines them into a PDF. While PDF assembly could be a supporting step in a comic workflow, this code chunk lacks the core declared behaviors—story generation, illustration generation, caption rendering, and style selection. Therefore the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: zhz-picture-story-book
description: 连环画生成器：每页一幅画+底部文字说明，支持多种画风。用于生成故事绘本、小人书、连环画、图文故事。Use when user asks to create "连环画", "故事绘本", "picture story", "illustrated story", or "picture book".
version: 1.0.0
---

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: zhz-picture-story-book
description: 连环画生成器:每页一幅画+底部文字说明,支持多种画风。用于生成故事绘本、小人书、连环画、图文故事。Use when user asks to create "连环画", "故事绘本", "picture story", "illustrated story", or "picture book".
version: 1.0.0
---

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instruction says generation prompts must be written in English to achieve best image quality, which imposes a specific language requirement in the skill's workflow. The policy allows language constraints only when the user is given a choice or when the constraint is clearly justified as a locale-specific tool; here it is presented as a fixed requirement rather than an opt-in choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file presents all instructions and examples exclusively in Chinese, which can constitute a language/locale policy issue when no user opt-in or explanation is provided. The file does not indicate that it is intended only for Chinese-language users or offer an alternative language option.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The script performs a system-modifying operation by installing a package, but the file contains no comment, prompt, or user-visible message explaining that it will change the environment. In a preinstall script, this action may still surprise users unless the behavior is disclosed here or in accompanying documentation.

Content

No source excerpt is available for this finding.