T01 · Skill Instruction Hijacking
Warning
- Location
references/style-01-坐标蓝图·波普实验室.md:22- Finding
Mandatory Third-Party Branding Injected into Generated Images
- Content
View full analysis
- Remediation
View remediation
Security audit
Hd Infoimage
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly does the advertised infographic generation, but it also tells agents to expose a local API key and send generated outputs through an unspecified Feishu script.
Review before installing. This skill should not be allowed to print local API keys or automatically send generated images to Feishu. Only use it with non-sensitive content, require explicit approval before any external delivery, and remove or rewrite the credential-reading and Feishu-sending instructions before trusting it in an agent workflow.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
README.md:49- Finding
API Key Extracted from OpenClaw Configuration and Printed to Standard Output
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:47- Finding
Generated Content Is Directed to an Unreviewed External Feishu Delivery Script
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger condition is broad enough to match common requests about articles, notes, visualizations, or knowledge graphics, which can cause the skill to activate unexpectedly. Overbroad activation increases the chance that operators or agents will run embedded operational steps, including image generation and related side effects, in situations where the user did not explicitly request this specific workflow.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document includes operational instructions to execute image-generation commands, access credentials, and send outputs externally, but provides no user-consent, data-handling, or secret-safety warnings. In context, this is dangerous because the skill processes user-supplied article content and may transmit it to third-party services or messaging endpoints without making those side effects explicit.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly instructs operators to read a provider API key from a local configuration file using a shell pipeline. That expands the skill’s capabilities from image generation into credential access, which is unnecessary for the stated user-facing purpose and creates a concrete risk of secret exposure, reuse in other contexts, or normalization of secret-handling by untrusted skill content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger description is broad enough that the skill could activate for many content-creation requests without a clear boundary on when it should be used. Over-broad invocation can cause unintended processing of user content and can chain into the documented outbound-sharing behavior, making accidental data exposure more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The usage example tells the operator to combine the user’s article with a prompt and generate an unspecified number of images, but it does not define scope, limits, or privacy expectations. Ambiguous invocation patterns increase the chance of over-processing or invoking the skill in contexts the user did not clearly intend.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill’s documented behavior expands from image generation into outbound delivery via
send_to_feishu.sh, which is a separate data-transmission capability. That creates an unexpected exfiltration path for user-provided content and generated outputs, especially since the manifest does not declare or justify external sharing.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Sending outputs through Feishu is not necessary for the stated purpose of generating high-density images and therefore violates least functionality. Unnecessary external delivery increases privacy and data-handling risk because generated images may embed sensitive user content from the source article.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction to send generated images via a shell script introduces data transmission to a third-party channel without any user-facing disclosure or confirmation. Because the generated image is derived from user-supplied article content, this can leak sensitive or proprietary information outside the expected execution environment.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a skill for generating high-density visual images from user-provided article/content. In this file, the documented workflow adds capabilities to search Xiaohongshu high-performing posts and call a knowledge base, which goes beyond straightforward content-to-image generation and is not declared in the skill description.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow explicitly requires searching Xiaohongshu high-like-count notes before generating output, which expands the skill beyond image creation into external platform research without clear user consent or necessity. In an agent setting, this can trigger unintended browsing, collection of third-party content, and policy/scope violations, especially if the runtime has network access.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The instruction 'All text in CHINESE' is a natural-language locale constraint that applies categorically to generated output. The file does not offer an opt-in, alternative language option, or a clear justification that this skill is restricted to a Chinese-only compliance or regional context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown instructs the agent to 'Include small English subtitles below main headings,' which imposes a specific language choice as part of the output format. The file does not provide an opt-in, alternative language option, or justification for why English is required.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to search internet platforms and gather external material, which expands behavior beyond the declared role of transforming user-provided content into infographic output. This creates scope creep: the agent may fetch unverified external content, introduce privacy/compliance issues, or act with capabilities the user did not explicitly authorize.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The content template explicitly says to add an English subtitle for every image, creating a fixed language policy in the generated output. Because no user choice or locale justification is provided, this conflicts with the language/locale policy guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Line L58 requires a 'Specific English prompt' for the generated visual prompt. This imposes a language constraint without any opt-in or alternative, which matches the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The heading explicitly labels this as an English MD version, which indicates a fixed language requirement. Because the file does not provide an opt-in or alternative language path, it may violate locale/language choice policy for users who did not request English.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The template requires an "English Midjourney/DALL-E prompt," which forces a specific language in generated content. The file does not mention user preference, fallback behavior, or a justified regional constraint.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
文件的描述和使用方式均以中文固定表述技能行为，没有说明是否支持其他语言或允许用户自行选择输出语言。若组织要求避免未经用户同意强制特定语言，这种单一语言约束属于自然语言层面的策略风险。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
This file presents the skill heading in Chinese while the operative instructions are written in English, but nowhere tells the user they may choose their preferred language or locale. Under the language/locale policy rule, imposing a language convention without explicit user choice can be a natural-language policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The skill content defines the role and workflow entirely in English despite the file title being Chinese, and it does not state that the user may choose the output language. This can create a language-policy issue if organizational guidance requires respecting user locale or offering opt-in for a specific language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The markdown prompt explicitly requires '中文标签用手写风格字体', which imposes a specific language choice. Under the policy criteria, forcing a language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.