Security audit

emoji-sticker-cn

Security checks across malware telemetry and agentic risk

Overview

The skill is a disclosed Chinese-platform sticker preparation helper with local image scripts and limited rule-maintenance guidance, not evidence of malicious behavior.

Install this only if you want help preparing sticker assets for Chinese platforms such as WeChat, Xiaohongshu, or Douyin. Review any rule-update diff before approving writes, remember that offline word checks are only a fallback and not a guarantee of platform approval, and be aware the README advertises two helper scripts that are not present in this package.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill makes strong compliance and safety claims—real-time banned-word checking, offline fallback, animated sticker generation, and rules maintenance workflows—but the finding indicates those controls are not actually implemented. In a compliance-focused skill, overstating safeguards is dangerous because users may rely on nonexistent checks, leading to policy violations, rejected submissions, or unsafe automated actions under false assurance.

Ae1

High

Category: analysis-evasion
Content: 3. **渲染**:`python3 scripts/animate_sticker.py cat.png --recipe happy --out cat_happy.gif`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 3. **渲染**:`python3 scripts/animate_sticker.py cat.png --recipe happy --out cat_happy.gif`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: 3. **渲染**:`python3 scripts/animate_sticker.py cat.png --recipe happy --out cat_happy.gif`
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The rule-update phrase '更新表情包规则' is especially ambiguous because it can trigger a networked update workflow (`WebFetch 官方源 → diff 报告 → 确认后落盘`) without clearly constraining source scope, target files, or requiring an explicit confirmation boundary in the invocation itself. In an agent setting, that increases the risk of accidental or prompt-induced external fetches and modification of local reference data.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The install instruction uses `npx clawhub@latest`, which fetches and executes the latest published package at install time without pinning to a known-good version. If the upstream package is compromised, typo-squatted, or a breaking/malicious release is published, users may execute unreviewed code during installation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases are broad natural-language commands such as '帮我做一套微信表情包' and '让这张贴纸动起来', which can overlap with ordinary user conversation and cause unintended skill activation. In an agent environment, ambiguous auto-invocation can expose local files, invoke scripts, or trigger processing workflows without sufficiently explicit user intent.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The description explicitly constrains the skill to Chinese platforms and presents the workflow as a Chinese-compliance assistant, but does not state that this locale restriction is optional or user-selected. Under the language/locale policy rule, forcing a specific locale without opt-in is a natural-language policy concern unless clearly documented as a justified region-specific tool.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This is a natural-language policy issue because the user-facing docstring, usage examples, argument descriptions, and output messages are all in Chinese, with no opt-in or alternative locale. The file does not state that the tool is intentionally limited to Chinese-speaking users or a China-specific workflow, so it imposes a language constraint by default.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: This is a natural-language policy issue because the file forces a single locale in its docstring and usage instructions rather than allowing the user to choose or documenting that the tool is region-specific. The same pattern continues in argument descriptions and runtime messages, so non-Chinese users are effectively excluded without opt-in.

Natural-Language Policy Violations

Low

Confidence: 85% confidence
Finding: The 'When to use' section lists broad sticker-generation requests as triggers for this Chinese-platform skill, which can cause the agent to apply a China-specific locale workflow even when the user did not request that locale. This is a natural-language locale-policy issue because the skill does not require confirming the user's target market before proceeding.

Natural-Language Policy Violations

Low

Confidence: 84% confidence
Finding: This file is natural-language guidance for a skill and it consistently uses Chinese-only instructions and labels. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation unless the constraint is explicitly documented and justified as region-specific.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: This code file contains natural-language strings such as the module docstring, CLI help text, and error output entirely in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.