Security audit

design-ads 海报制作

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local poster generator that saves rendered images and HTML copies on the user's machine, with no evidence of exfiltration or destructive behavior.

Install only if you are comfortable with the skill saving extra local copies of both the generated PNG and source HTML under Downloads. Use it for non-sensitive poster drafts, review or avoid untrusted HTML inputs, and delete the generated design-ads Downloads folder if the content should not persist.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior materially exceeds the user-facing description: it renders local HTML files and automatically copies both generated PNGs and source HTML into the user's Downloads directory. That creates an unexpected local file handling and data exposure risk, especially if user content or sensitive prompts are embedded in the HTML, and the mismatch reduces informed user consent and reviewer visibility.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script silently copies both the source HTML and generated PNG into a folder under the user's Downloads directory, which exceeds the core rendering function and can expose user content unexpectedly. Because the HTML may contain sensitive prompts, text, or embedded local references, this creates an unnecessary data propagation risk without user consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The code enumerates the user's Downloads directory, inspects folder metadata, reuses prior design-ads folders, and creates new directories there. For a poster-rendering utility, scanning and modifying a personal Downloads folder is broader filesystem access than necessary and may expose user file structure or cause unintended artifact placement.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The header comment states the tool renders HTML to PNG, but it also performs undisclosed copying into Downloads. This documentation mismatch is dangerous because users and reviewers may underestimate the script's filesystem side effects, reducing informed consent and making unexpected data persistence more likely.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger phrases are broad enough to match many generic requests for posters, covers, ads, or vertical images, which can cause the skill to activate when the user did not intend to use it. Unintended invocation is risky here because the skill performs local file generation and export side effects, so accidental activation can still create files or expose content unexpectedly.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Automatically copying generated artifacts into the Downloads directory without a clear upfront warning is a real security and privacy issue because users may not expect locally saved copies of potentially sensitive content. Since the copied artifacts include the source HTML, not just the final image, the skill may preserve prompts, embedded text, or other internal content in a more reusable and inspectable form than the user intended.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: This renderer loads arbitrary HTML into a full browser context with `page.setContent(..., { waitUntil: 'networkidle0' })`, which allows embedded external resources such as images, fonts, stylesheets, and scripts to trigger outbound network requests. In this skill, that can leak usage metadata, contact attacker-controlled hosts, or cause server-side request behavior during rendering without any disclosure or restriction, making it a real security issue even if the implementation appears intended only for image generation.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script copies the input HTML and output PNG into Downloads without any warning, prompt, or confirmation. In this skill context, the generated content is user-provided design material that may contain private business copy, internal prompts, or other sensitive text, so silent duplication increases the chance of inadvertent disclosure.

Static analysis

No suspicious patterns detected.