Security audit

Long Image Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear image-generation purpose, but it can send generated images to external hosting and loads remote web scripts without a clear consent step.

Before installing, assume generated images may include sensitive notes, documents, or code. Use local output by default, require explicit approval before any upload, and review/remove the fixed footer attribution if it is not wanted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:149
Finding: Fixed Third-Party Branding Injected into Generated Images
Content: View full analysis
🦞 定积出品 ``` ### Technical Analysis The general-purpose course-note template contains a hardcoded third-party attribution. When the template is used without modification, this attribution becomes part of the generated image even if the user did not request branding. This does not provide system access or code-execution privileges. However, it changes the integrity of the user's output and can cause users to publish promotional or misleading attribution unknowingly. Because the branding is embedded directly in the reusable template rather than represented by an optional placeholder, normal use of the documented template triggers the behavior. ### Attack Path 1. A user requests a course-note image or another output suited to Template A. 2. The agent selects the documented template. 3. The template is rendered without removing the fixed footer. 4. The generated image contains the third-party attribution. 5. The user may distribute the image without noticing that unrelated branding was inserted. ### Impact Assessment The issue affects the integrity and presentation of generated images. It does not grant filesystem, network, or operating-system privileges. Its scope is limited to outputs generated from the affected template, but it may create reputational, attribution, or content-authenticity concerns for users who publish those outputs. ]]>
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:82
Finding: Remote JavaScript Dependencies Loaded Without Integrity Verification
Content: View full analysis
``` ```html ``` ### Technical Analysis The skill instructs the renderer to retrieve and execute JavaScript from `cdn.jsdelivr.net` at image-generation time. Although explicit package versions are present, the resources are not protected by Subresource Integrity hashes and are not bundled as locally reviewed assets. Consequently, the code actually executed by the Canvas environment depends on content returned by an external service after the skill itself has been reviewed. A compromise of the CDN, upstream package artifacts, DNS or network path, or dependency publishing process could substitute malicious JavaScript. The resulting privileges depend on the Canvas renderer's security boundary. A substituted script would execute in the rendered document's context and could access document content, including user-provided notes or code embedded in the page. If the rendering environment exposes privileged APIs or lacks adequate sandboxing, the consequences could extend beyond document-content access. ### Attack Path 1. An attacker compromises the relevant CDN response, upstream artifact, or delivery path. 2. A user asks the skill to generate an image containing formulas or highlighted code. 3. The Canvas renderer loads the remote KaTeX or Highlight.js script. 4. Because no integrity hash validates the resource, the altered JavaScript is accepted and executed ...[truncated 695 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:121
Finding: Generated User Content May Be Uploaded to Third-Party Hosting Without Required Consent
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger conditions are broad enough to match generic requests about posters, cards, or converting notes to images, increasing the chance of unintended invocation. Overbroad activation can cause the agent to apply this skill in contexts where users did not intend image rendering, potentially leading to unnecessary processing or exposure of content to risky rendering/upload steps.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template imports fonts and scripts from public CDNs, creating network dependencies not strictly required for local image generation. This can leak metadata, reduce reproducibility, and expose the rendering pipeline to supply-chain or content tampering risks if remote assets change or are compromised.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs uploading generated images to external file-sharing services, which introduces unnecessary data exfiltration risk beyond the core image-rendering function. If users render sensitive notes, documents, or internal content, pushing outputs to third-party services could expose confidential information without clear consent or controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill suggests external uploading but does not warn users that generated images may be transferred to third-party services. Without a disclosure and consent step, users may unknowingly share sensitive rendered content outside the local environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description and trigger instructions are written in Chinese, and the skill does not indicate that users may choose another language or that the Chinese-only presentation is required for a specific regional context. This can constitute a language/locale policy issue when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.