Long Image Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:39 AM UTC
• Version: 1.0.3

Overview

The skill has a clear image-generation purpose, but it can send generated images to external hosting and loads remote web scripts without a clear consent step.

Before installing, assume generated images may include sensitive notes, documents, or code. Use local output by default, require explicit approval before any upload, and review/remove the fixed footer attribution if it is not wanted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T01 · Skill Instruction Hijacking

Note

• Location: SKILL.md:149
• Finding: Fixed Third-Party Branding Injected into Generated Images<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:149` **Vulnerability Type**: Output integrity violation through undisclosed fixed branding **Risk Level**: Low ### Vulnerable Code Snippet ```html <span style="color:#1D3557; font-size:24px;">🦞 定积出品</span> ``` ### Technical Analysis The general-purpose course-note template contains a hardcoded third-party attribution. When the template is used without modification, this attribution becomes part of the generated image even if the user did not request branding. This does not provide system access or code-execution privileges. However, it changes the integrity of the user's output and can cause users to publish promotional or misleading attribution unknowingly. Because the branding is embedded directly in the reusable template rather than represented by an optional placeholder, normal use of the documented template triggers the behavior. ### Attack Path 1. A user requests a course-note image or another output suited to Template A. 2. The agent selects the documented template. 3. The template is rendered without removing the fixed footer. 4. The generated image contains the third-party attribution. 5. The user may distribute the image without noticing that unrelated branding was inserted. ### Impact Assessment The issue affects the integrity and presentation of generated images. It does not grant filesystem, network, or operating-system privileges. Its scope is limited to outputs generated from the affected template, but it may create reputational, attribution, or content-authenticity concerns for users who publish those outputs. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the fixed attribution from the default template. - If attribution is a legitimate feature, replace it with an optional placeholder such as `${footerAttribution}`. - Disable attribution by default and render it only after explicit user consent. - Clearly preview or disclose all footer content before generating the final image. - Add a template review test that rejects undeclared fixed branding or promotional text. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:82
• Finding: Remote JavaScript Dependencies Loaded Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:82-83, 92-93` **Vulnerability Type**: Runtime retrieval and execution of unverified remote dependencies **Risk Level**: Medium ### Vulnerable Code Snippet ```html <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.css"> <script src="https://cdn.jsdelivr.net/npm/katex@0.16.9/dist/katex.min.js"></script> ``` ```html <link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/highlightjs/cdn-@11.9.0/build/styles/github.min.css"> <script src="https://cdn.jsdelivr.net/gh/highlightjs/cdn-@11.9.0/build/highlight.min.js"></script> ``` ### Technical Analysis The skill instructs the renderer to retrieve and execute JavaScript from `cdn.jsdelivr.net` at image-generation time. Although explicit package versions are present, the resources are not protected by Subresource Integrity hashes and are not bundled as locally reviewed assets. Consequently, the code actually executed by the Canvas environment depends on content returned by an external service after the skill itself has been reviewed. A compromise of the CDN, upstream package artifacts, DNS or network path, or dependency publishing process could substitute malicious JavaScript. The resulting privileges depend on the Canvas renderer's security boundary. A substituted script would execute in the rendered document's context and could access document content, including user-provided notes or code embedded in the page. If the rendering environment exposes privileged APIs or lacks adequate sandboxing, the consequences could extend beyond document-content access. ### Attack Path 1. An attacker compromises the relevant CDN response, upstream artifact, or delivery path. 2. A user asks the skill to generate an image containing formulas or highlighted code. 3. The Canvas renderer loads the remote KaTeX or Highlight.js script. 4. Because no integrity hash validates the resource, the altered JavaScript is accepted and executed ...[truncated 695 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bundle reviewed KaTeX and Highlight.js assets locally with the skill rather than retrieving them at runtime. - If remote hosting is unavoidable, use exact immutable asset URLs and add valid `integrity` and `crossorigin` attributes to every remote script and stylesheet. - Verify dependency hashes as part of the build or installation process. - Apply a restrictive Content Security Policy that permits scripts only from explicitly approved sources and blocks unnecessary outbound connections. - Render untrusted content in a sandbox with no filesystem, credential, privileged API, or unrestricted network access. - Maintain an allowlist of reviewed dependency versions and periodically scan them for known vulnerabilities. ]]>

other

Warning

• Location: SKILL.md:121
• Finding: Generated User Content May Be Uploaded to Third-Party Hosting Without Required Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:121` **Vulnerability Type**: Potential unconsented third-party data disclosure **Risk Level**: Medium ### Vulnerable Code Snippet ```text 使用 lightclaw_upload_file 上传并提供下载链接，或用 litterbox 临时链接。 ``` The instruction directs the agent to upload the file using `lightclaw_upload_file` and provide a download link, or to use a temporary Litterbox link. ### Technical Analysis The documented workflow recommends sending generated images to an external upload service. Generated images may contain private notes, proprietary documents, source code, educational records, or other user-supplied information. The instruction does not require explicit consent, a sensitivity check, destination disclosure, access-control verification, or disclosure of retention and deletion behavior before upload. A temporary link does not inherently make data private. Anyone possessing or discovering the link may be able to retrieve the file, and the hosting provider necessarily receives the uploaded content. ### Attack Path 1. A user supplies sensitive text, code, notes, or document content for conversion into an image. 2. The agent renders that information into a PNG file. 3. Following the documented workflow, the agent uploads the PNG through `lightclaw_upload_file` or Litterbox. 4. The external provider receives and stores or processes the generated content. 5. The file may be accessible through a shareable link or retained according to provider-specific policies that were not disclosed to the user. ### Impact Assessment The issue can disclose the complete contents of a generated image to a third-party provider and potentially to anyone who obtains its link. The affected scope is limited to files selected for upload, but a single image may contain substantial confidential information. This workflow does not establish system privilege escalation. Its principal impact is confidentiality loss and loss of user control over st ...[truncated 75 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Keep generated files local by default. - Require explicit, informed user consent immediately before every third-party upload. - Identify the destination provider and disclose expected visibility, retention, expiration, and deletion behavior. - Warn users when generated content appears to contain secrets, personal data, proprietary code, or other sensitive information. - Prefer authenticated storage with access controls and short expiration periods over public or bearer-link hosting. - Provide a local file path or direct in-session attachment when supported. - Confirm successful deletion when temporary remote storage is no longer needed. - Record only minimal non-sensitive audit metadata and never log the uploaded content or public access token unnecessarily. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger conditions are broad enough to match generic requests about posters, cards, or converting notes to images, increasing the chance of unintended invocation. Overbroad activation can cause the agent to apply this skill in contexts where users did not intend image rendering, potentially leading to unnecessary processing or exposure of content to risky rendering/upload steps.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The template imports fonts and scripts from public CDNs, creating network dependencies not strictly required for local image generation. This can leak metadata, reduce reproducibility, and expose the rendering pipeline to supply-chain or content tampering risks if remote assets change or are compromised.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs uploading generated images to external file-sharing services, which introduces unnecessary data exfiltration risk beyond the core image-rendering function. If users render sensitive notes, documents, or internal content, pushing outputs to third-party services could expose confidential information without clear consent or controls.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill suggests external uploading but does not warn users that generated images may be transferred to third-party services. Without a disclosure and consent step, users may unknowingly share sensitive rendered content outside the local environment.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The manifest description and trigger instructions are written in Chinese, and the skill does not indicate that users may choose another language or that the Chinese-only presentation is required for a specific regional context. This can constitute a language/locale policy issue when no opt-in or justification is provided.

Static analysis

No suspicious patterns detected.