Security audit

style-card

Security checks for vulnerabilities and agentic risk

Overview

The image-design workflow fits its purpose, but PNG export can silently install software globally despite claims of zero external dependencies.

Before using HTML export, provision a reviewed Playwright version locally and disable the automatic global-install fallback. Expect Google Fonts network requests and persistent updates to the style library. The supplied static scan reported no findings; the Review verdict rests on the exporter’s actual setup behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The supplied chunk is a generic HTML screenshot exporter. It does not analyze reference images, construct or store structured style cards, consult a style library, or generate imagery from text and learned styles. PNG export could support a broader workflow, but the chunk provides no connection to the declared style-card workflow and instead explicitly targets HTML knowledge cards. Its local file access and Playwright setup are implementation details, not independent grounds for the mismatch.
Content: No source excerpt is available for this finding.

The generation prompt requires a Chinese-language title without user opt-in.

Medium

Category: Output Handling
Confidence: 96% confidence
Finding: The prompt explicitly instructs the agent to render an oversized Chinese title (「超大像素中文标题」). This imposes a specific output language without offering a language choice or documenting a locale-specific reason for the restriction.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx playwright'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx playwright'.

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Although this is not an MCP server, the command invokes an unpinned npm executable and falls back to an unpinned global installation of Playwright. A compromised newly resolved release or dependency could execute code with the invoking user's privileges; screenshot export legitimately needs browser tooling, but does not require mutable runtime installation.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx playwright'.

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The screenshot command executes Playwright through npx without binding it to an approved project-local version. This shares the dependency-resolution risk of line 25 rather than representing a separate MCP issue: a compromised resolved package could run with access to the user's files and environment.
Content: No source excerpt is available for this finding.

The quotation style requires English-language source text without user opt-in.

Low

Category: Output Handling
Confidence: 88% confidence
Finding: The quotation specification explicitly calls for italicized English original text (「斜体英文原文」). This imposes a language requirement on quoted content without offering a language choice or explaining why English is necessary for this visual style.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.