T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/smart_draw.py:266- Finding
Unrestricted Local Image Loading Through Scene Layers
- Content
View full analysis
- Remediation
View remediation
Security audit
Ccy Txt2img
Security checks for vulnerabilities and agentic risk
Overview
This is a local Pillow-based image generation skill with no network, credential, persistence, or hidden execution behavior, though users should avoid rendering untrusted scene JSON without path and size controls.
Install only if you want a local Pillow-based text and simple scene renderer. Treat scene JSON from other people as untrusted: review image layer paths before rendering, avoid absolute or sensitive local paths, and keep width, height, layer count, and source image sizes reasonable.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/smart_draw.py:213- Finding
Unbounded Scene Dimensions and Layer Count Allow Resource Exhaustion
- Content
View full analysis
- Remediation
View remediation
MAX_PIXELS: raise ValueError("Canvas exceeds the maximum pixel count") layers = scene.get("layers", []) if not isinstance(layers, list) or len(layers) > MAX_LAYERS: raise ValueError("Scene contains too many layers") ``` Equivalent dimension validation should be applied in `render_text_image` and to all layer-specific intermediate image allocations. ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
该代码没有表现出越权、联网或与本地离线处理不符的行为，且确实使用 Pillow 输出 PNG/JPEG，因此与声明中的“本地离线”“文本转图片”部分一致。但声明描述的是一个更广泛的图片生成/绘图技能，包含图形绘制、填充描边、图片合成和规则驱动智能绘制等能力；当前提供的代码仅实现文本渲染到图片及简易代码截图风格输出，属于声明能力的一个子集。由于声明明显高于实际实现范围，且核心功能范围存在实质性差异，应判定为描述与代码行为不匹配。
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file contains natural-language text indicating the skill is presented in Chinese, and later user-facing strings are also hard-coded in Chinese. Because the file does not offer any language or locale opt-in, it may violate language-choice policy for general users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guidance says '中文文本优先使用系统 NotoSansCJK / 文泉驿字体', which imposes a Chinese-first language/font preference in natural-language instructions. The file elsewhere supports both Chinese and English, but this line does not present the preference as an optional user choice or a clearly justified locale restriction.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file is entirely written in Chinese and does not provide an alternative language option or state that the skill is intentionally limited to Chinese-speaking users. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This text is entirely presented in Chinese and specifically frames usage around Chinese fonts, without indicating any language choice or opt-in for users who may need documentation in another language. Under the policy rule for language or locale constraints, this can be considered a natural-language locale restriction unless explicitly documented as optional or region-specific.
- Content
Static analysis
No suspicious patterns detected.