Security audit

mcp-storyboard

Security checks across malware telemetry and agentic risk

Overview

This storyboard image skill is not malicious, but it needs review because it automatically adds sexualized person-specific prompt text to broad character requests before sending them to BizyAir.

Install only if you are comfortable sending prompts and your BizyAir API key to BizyAir, and review or disable the automatic model prompt suffix before using it for ordinary character, children, or picture-book scenes. Set batch size explicitly, avoid placing sensitive story details in prompts, and prefer safer secret storage over a long-lived key in shell startup files.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no permissions while its instructions clearly require environment-variable access, outbound network calls to BizyAir, and shell-based curl fallback. This under-specification can bypass expected consent and review controls, causing users or orchestrators to invoke a capability-rich skill without understanding that prompts and data may be transmitted externally.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented purpose says the skill generates storyboard images, but the actual behavior silently injects highly sexualized and identity/style-specific prompt content such as '大胸展示' and '完美身材'. This is dangerous because it materially changes user intent, can produce unsafe or policy-violating outputs, and may create reputational, compliance, or harassment risks when benign requests are transformed into sexualized content.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The script automatically appends explicitly sexualized prompt content whenever it detects broad person-related keywords such as 'girl', 'woman', 'portrait', or '人物'. In a storyboard/children's illustration context, this silently changes user intent and can coerce benign requests into sexualized image generation, creating safety, policy, and reputational risk, including unsafe generation involving age-ambiguous subjects.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The implementation does not merely add a generic 'model prompt'; it injects a very specific sexualized persona and body-description payload unrelated to ordinary storyboard assistance. This mismatch is dangerous because it hides materially different behavior behind benign wording, preventing informed user consent and increasing the chance of inappropriate or policy-violating outputs.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill silently appends a fixed sexualized prompt including terms like '大胸', 'young woman', and '20-year-old asian woman' whenever person-related keywords are detected. This creates an unjustified capability shift from neutral storyboard generation to sexualized person-image generation, increasing risk of policy violations, unsafe outputs, and harmful or non-consensual depictions unrelated to user intent.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The skill auto-injects a sexualized, model-specific suffix into prompts when it detects broad people-related keywords such as '人物' or 'girl'. This materially changes user intent, can generate unsafe or non-consensual sexualized content, and sends the altered prompt to a third-party API without explicit consent.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The implementation contradicts the advertised neutral 'automatic model prompt append' feature by appending a narrowly sexualized portrait preset. Because the trigger terms are broad, normal storyboard prompts involving characters can be silently transformed into eroticized portrait generation requests.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advises storing the API key in shell startup files such as ~/.zshrc or ~/.bashrc without warning that these files may be broadly readable, backed up, synced, or accidentally committed or shared. This increases the risk of credential exposure and unauthorized use of the BizyAir account.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation rules use broad trigger phrases like '分镜', '场景图', and '绘本', which can match many ordinary requests and force the skill to run unnecessarily. Because this skill can call external APIs and shell commands, over-broad auto-invocation increases the chance of unintended data transmission or surprise tool use without clear user intent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill specifies automatic fallback from MCP to shell curl and external API calls, but it does not clearly warn users that their prompts may be transmitted directly over the network to a third party. This weak transparency can expose sensitive story content, personal data, or proprietary material through an unexpected transport path.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends the user's prompt and bearer-authenticated request to a third-party remote service, but it does not provide an explicit disclosure or consent step before transmitting potentially sensitive story, character, or proprietary content. In an agent skill context, users may reasonably assume local processing unless network disclosure is made clear.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script modifies the user's prompt before transmission without explicit pre-submission disclosure or confirmation of the exact final text sent to the external API. In this skill, that hidden rewrite is especially risky because the appended content is sexualized and materially changes the semantics of the user's request.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tool description does not clearly tell users that their prompts will be transmitted to BizyAir, a third-party external service. Users may unknowingly submit sensitive story, personal, or proprietary content to an external processor, creating privacy and data-handling risk.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The code enriches user prompts with sexualized descriptors and forwards the result to an external image API automatically. In the context of a general storyboard/illustration skill, this is more dangerous because users asking for ordinary scenes with people may unexpectedly generate disallowed or inappropriate content and leak the modified prompt externally.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: storyboard-mcp.js:467