Colorpick

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:07 AM UTC
• Version: 2.0.0

Overview

This looks like a color utility, but one included script mainly saves user inputs into persistent local history instead of only doing color conversion.

Review this before installing. Avoid entering secrets, client names, proprietary palette notes, or other sensitive text into this tool unless the logging behavior is removed or made opt-in with clear deletion controls. The artifact does not show exfiltration or destructive behavior, but its persistent local history is under-disclosed and mismatched with a simple color utility.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill metadata and documentation present the tool as a simple color picker/converter, but the described analyzed behavior includes persistent logging of user inputs, history/search/statistics over stored data, and export of accumulated logs. That is a significant capability expansion beyond the declared purpose and can expose sensitive prompts, filenames, tokens, or other user-provided data through undisclosed retention and export features. In this context, a utility skill should be narrowly scoped, so hidden or undocumented data collection is especially concerning.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script’s advertised purpose is a color picker/converter, but its actual behavior is dominated by collecting, storing, replaying, searching, and exporting user-provided inputs. This mismatch is security-relevant because users may disclose sensitive data to a tool they reasonably expect to be a simple local utility, while the script silently builds a persistent activity history that can later be re-exposed from disk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says "Use when you need colorpick," which does not define specific trigger phrases, context, or boundaries for when the skill should activate. This is broad and ambiguous enough to risk unintended invocation because it provides no concrete scope or exclusion conditions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script’s natural-language interface and help text are presented in Chinese, including the title, usage descriptions, and examples, with no indication that another language is available. Because this is a general-purpose color utility rather than a clearly region-specific tool, the hardcoded locale constitutes a language-policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The help text says contrast <fg_hex> <bg_hex>, implying the first positional argument is the foreground color. But in the Python implementation, after the shell shifts off the command name, contrast reads args[0] and args[1] from sys.argv, where args[0] is actually the subcommand string contrast, so a call like the documented example on L026 makes the code treat contrast as the foreground value and the first real color as the background. This is an active contradiction between the usage documentation and actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The help text documents convert <color> and provides an example with a hex value, but the Python code assigns color_input = args[0], where args[0] is the literal subcommand convert because the heredoc Python process is not given the shifted shell arguments. As a result, the documented invocation does not behave as described and attempts to parse convert as a color.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation and command names imply genuine color-processing operations, but most commands only save arbitrary input text and echo it back. This deceptive or misleading implementation increases the chance that users trust the tool with data they would not knowingly provide to a logger, making the privacy impact materially worse in this skill context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script persistently logs all user inputs across many commands into plaintext files under the user’s home directory, despite the stated use case not requiring long-term tracking. That creates an unnecessary privacy and confidentiality risk because any secrets, internal project names, or sensitive design text entered by mistake become durable local artifacts and are later exportable.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script stores and re-exposes all user-provided inputs in plain language through search, recent, status, and export functionality. In the context of a purported color utility, this broad plaintext retention is unnecessary and increases the risk of sensitive data disclosure through local access, backups, screenshots, or accidental sharing of exported files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The export feature aggregates prior logged activity from all log files into new JSON/CSV/TXT files, multiplying the number of plaintext copies of potentially sensitive user input. Because the tool does not clearly warn that historical data will be materialized into export files, users may unintentionally create additional durable artifacts that are easier to share, leak, or ingest elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At this location and throughout similar command handlers, user input is written to persistent plaintext logs without any upfront warning that entries are retained. This is dangerous because users may assume inputs are transient command arguments, while the script quietly creates a searchable history on disk that can expose sensitive information to other local processes, backups, or later exports.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The help text says generate <theme>, but in Python the branch sets theme = args[1] if len(args) > 1 else "tech" while args is derived from sys.argv[1:] of a Python process launched without the shell arguments. In practice, the documented theme parameter is not wired through as the documentation claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file’s instructional content is entirely in Chinese, and there is no indication that users can choose another language or that the locale restriction is intentional. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.