codia-design-skills

• Outcome: Review
• Latest audit: Jul 26, 2026 · 5:21 PM UTC
• Version: 0.1.4

Overview

The skill pack is coherent, but it can change billing-related auto-recharge settings and transmit user files to Codia APIs without consistently requiring explicit confirmation.

Install only if you are comfortable with a local agent using an authenticated Codia CLI, uploading selected images/PDFs/URLs to Codia for processing, writing downloaded outputs locally, and reading account/usage data. Require the agent to ask before enabling or changing auto-recharge, before uploading sensitive documents or private images, and before using public URLs or callback URLs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill enables and configures automatic credit purchases through a simple CLI/API workflow but does not require an explicit user confirmation acknowledging real billing consequences. An agent following this skill could change recharge settings and cause future paid charges once thresholds are crossed, especially if the user’s request is ambiguous or the agent acts proactively.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The frontmatter description activates on broad phrases like 'use Codia Design' without requiring a narrower task boundary. In a skill-routing system, this can cause the router to select this skill for generic requests, increasing the chance of unintended command execution paths such as install, auth, or account operations that the user did not explicitly request.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The invocation guidance lists broad triggers such as asking broadly to use Codia or needing the exact tool chosen, but it does not define clear non-matches or confirmation requirements. In context, this skill can orchestrate installation, authentication, and multi-step CLI workflows, so ambiguous routing materially increases the risk of overbroad tool use and actions beyond the user's precise intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly asks for source document or image paths/URLs and instructs the agent to download and process files through external Codia APIs, but it provides no warning that user-supplied documents may be transmitted to a third-party service or stored locally. This creates a real privacy and data-handling risk, especially for sensitive PDFs, screenshots, reports, or internal marketing materials, because users may disclose confidential content without informed consent.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger description is broad enough that the skill may activate for many generic image-related requests without strong boundaries or disambiguation. Over-broad activation can cause the agent to invoke external tooling and consume credits unexpectedly, or route user requests into this skill when a safer or more appropriate path should have been chosen.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill states only later in the response section that the CLI downloads generated images by default, but it does not clearly warn users up front that invoking the command will write files to the local filesystem. This can surprise users, cause unintended persistence of generated assets, and create privacy or storage-management issues in environments where agents are expected to avoid side effects unless explicitly disclosed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs users to supply public HTTPS image URLs for async/poll mode and optionally a callback URL, but it does not warn that doing so can disclose user-controlled content and metadata to external services. This can lead to unintended sharing of sensitive screenshots, internal design assets, signed URLs, or webhook destinations, especially because the skill explicitly encourages uploading local images to user-owned storage/CDN first.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger description includes broad phrases like 'increase resolution,' 'enhance output quality,' and 'improve generated images,' which can match many ordinary user requests outside the intended scope. In an agent environment, this can cause unintended invocation of a paid external CLI/API, leading to unnecessary actions, cost consumption, and accidental transmission of user-supplied image paths or URLs to the third-party service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly supports `--pdf` as a public HTTPS URL and states that the CLI/API will send that URL to the external Codia service, but it does not clearly warn the user that the referenced document will be transmitted to a third-party processor. If users provide sensitive or internal document URLs, this can cause unintended disclosure of confidential content or metadata to an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill handles local PDF paths and public PDF URLs by uploading the document or sending the URL to Codia's remote service, but the top-level description does not clearly warn the user that their document contents leave the local environment. This can cause inadvertent disclosure of sensitive or regulated data because users may assume a local conversion workflow when the description only says it converts PDFs with the CLI.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly supports local image paths and public URLs, and its output is a remote CDN URL, which implies user-provided image content may be uploaded to a third-party service. Without a clear user-facing warning about remote transmission and storage/hosting, users may unknowingly expose sensitive local images, screenshots, documents, or product assets to an external API/CDN.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Codia Design Skills

Codia Design Skills gives local AI agents a reliable way to call Codia Open API from normal project work. After installation, an agent can inspect screenshots, convert PDFs into design data, generate or edit images, remove backgrounds, create SVG assets, export PDFs to PPT, and check account usage through the local `codia-design` command.

This repository is for agent skills. The skill files teach Codex, Claude Code, Cursor, and other agents when to use Codia, which workflow to choose, and how to call the runtime safely. The runtime CLI is installed separately and performs the authenticated API requests on the user's machine.

• Confidence: 68% confidence
• Finding: The README describes a locally installed CLI that performs authenticated API requests and later states that auth state is stored in ~/.codia/design-skills/config.json. Persistent local session material increases exposure to credential theft or unintended reuse by other local agents, especially in shared environments or when agents are allowed to inspect local files.

Static analysis

No suspicious patterns detected.