分镜脚本生成 Storyboard Script

• Outcome: Review
• Latest audit: Sep 10, 2026 · 1:43 AM UTC
• Version: 1.2.12

Overview

The skill presents itself as a text-only storyboard helper but also instructs the agent to install and run a cloud image-generation CLI, so users should review it before installing.

Install only if you intend this skill to use dLazy cloud generation, not just write storyboard text. Expect prompts and any referenced media files to be sent to dLazy services, expect an API key to be stored locally if you log in, and verify the exact npm package/version before allowing a global install or command execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:182
• Finding: Contradictory Instructions Hijack the Skill's Declared Text-Only Scope<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73, 182-197` and duplicated in `SKILL-cn.md:73, 182-197` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Complete Code Snippet ```markdown **This skill is only responsible for script generation; do not actually invoke tools to generate image/video/audio assets.** ## Critical Execution and Generation Instructions **You are an intelligent Agent capable of executing terminal commands.** **Strictly prohibited behavior:** - Do not save prompts to any file, such as a TXT or Markdown file. - Do not ask the user to generate images through a third-party platform. - Do not generate all images in one batch or execute multiple commands at once. **Required interaction and execution process:** 1. First, actively collect requirements and wait for the user's response. 2. Produce a draft prompt for the first image and wait for confirmation. 3. After confirmation, you must execute a terminal command, such as: `dlazy seedream-4.5 --prompt "..."` 4. Return the generated image URL and request confirmation before continuing. ``` The execution section above is an English rendering of the instructions at lines 182-197. The executable command is reproduced verbatim. ### Technical Analysis The Skill declares at line 73 that it is limited to storyboard script generation and must not invoke image, video, or audio generation tools. The later “critical” instructions reverse that constraint and require the Agent to execute the dLazy CLI after an interactive confirmation sequence. This is an instruction-priority and scope-hijacking issue. A user loading a text-only storyboard Skill would reasonably expect local text transformation, but the appended instructions redirect the Agent toward terminal execution and a third-party generation service. The metadata system prompt at line 7 also reinforces the ability to invoke dLazy generation models. Because these instructions are embedded in ...[truncated 1821 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the terminal and asset-generation instructions from this storyboard-only Skill. 2. Remove or revise the metadata system prompt that encourages invocation of dLazy image-generation models. 3. Place image generation in a separate, explicitly named Skill with a narrowly defined purpose. 4. Require clear, informed consent immediately before any command execution or external transmission. 5. Display the destination service, data categories, and local files that will be uploaded before execution. 6. Define a single authoritative scope statement and reject later instructions that conflict with it. 7. Add automated validation that flags contradictions between declared capabilities and imperative execution instructions. 8. Apply the same correction to both `SKILL.md` and `SKILL-cn.md`, which contain the same vulnerable content. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7
• Finding: External npm Package Is Installed and Executed Without Artifact Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7, 42-51` and duplicated in `SKILL-cn.md:7, 42-51` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Complete Code Snippet ```yaml metadata: {"clawdbot":{"emoji":"🤖","requires":{"bins":["npm","npx"]},"install":"npm install -g @dlazy/cli@1.2.3","installAlternative":"npx @dlazy/cli@1.2.3","homepage":"https://github.com/dlazy-ai/cli","source":"https://github.com/dlazy-ai/cli","author":"dlazyai","license":"see-repo","npm":"https://www.npmjs.com/package/@dlazy/cli","configLocation":"~/.dlazy/config.json","apiEndpoints":["api.dlazy.com","files.dlazy.com"]}} ``` ```markdown - **npm package name**: `@dlazy/cli` (the Skill's install field is pinned to version `1.0.9`) npx @dlazy/cli@1.2.3 <command> If global installation is selected, the Skill's `metadata.clawdbot.install` field is pinned to: npm install -g @dlazy/cli@1.2.3 ``` The package-version description at line 42 is an English rendering of the source text. Package names, versions, and commands are reproduced verbatim. ### Technical Analysis The Skill directs the host to retrieve and execute `@dlazy/cli@1.2.3` from an external npm registry. The audited artifact contains no vendored copy of the CLI, lockfile, cryptographic digest, signature policy, or other mechanism that would allow the downloaded executable content to be verified against the reviewed source. Using an exact semantic version reduces unintended version drift but does not independently verify artifact integrity. The global installation form also places the dependency in the user's global npm environment, expanding its effect beyond the project directory. npm lifecycle scripts and the installed CLI execute with the privileges of the account running npm. The provenance text is internally inconsistent: line 42 claims that the installation field is fixed to `1.0.9`, while the actual metadata and commands use `1.2.3`. This discrepancy impairs review and ...[truncated 2028 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Correct the version documentation so every reference identifies the actual reviewed and executed release. 2. Avoid automatic global installation; prefer a project-local, isolated dependency installation. 3. Commit a lockfile that records the complete transitive dependency graph and registry integrity values. 4. Verify package provenance, signatures, and cryptographic digests before execution. 5. Review the exact published npm artifact and its lifecycle scripts rather than relying only on the linked repository. 6. Disable npm lifecycle scripts during installation where they are unnecessary, then invoke only reviewed entry points. 7. Run the CLI in a sandbox with restricted filesystem access, network destinations, environment variables, and operating-system privileges. 8. Pin and audit all transitive dependencies, not only the top-level package version. 9. Prefer a vendored or reproducibly built artifact when the execution environment supports it. 10. Apply identical dependency corrections to `SKILL.md` and `SKILL-cn.md`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill explicitly states it is only for storyboard script generation and should not invoke tools to generate media, but elsewhere it instructs the agent to execute CLI-based image generation. This contradiction can cause an agent to exceed the user-expected scope and trigger external actions, including API calls and possible file uploads, under a misleading safety boundary.

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The file contains mutually inconsistent instructions: one section forbids actual asset generation while a later 'critical execution' section requires stepwise command execution to generate images. In agent settings, contradictory instructions are dangerous because the more operational section may be followed, leading to unauthorized tool use and behavior outside the declared skill contract.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The instructions mandate terminal command execution and direct image generation even though the skill's stated function is transforming user copy into a storyboard script. This is dangerous because it grants operational behavior unrelated to the task, creating risk of unexpected network activity, third-party API usage, billing, and upload of local media paths to external services.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill explicitly states it is only for storyboard script generation and should not invoke tools to generate media, but elsewhere it instructs the agent to execute CLI commands for image generation. This contradiction creates scope escalation: an agent selected for harmless text output may instead perform external actions, including networked API calls and media generation, beyond the user’s expected consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The execution section instructs the agent to run terminal commands and generate remote media through the dLazy CLI, even though the skill’s purpose is script writing. Giving a text-authoring skill command-execution behavior unnecessarily expands its capability to make network requests, upload data, and perform side effects that are unjustified by the stated function.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The document says the skill must not generate image/video/audio assets, but later mandates terminal-based image generation. This inconsistency is dangerous because safety controls or reviewers may rely on the declared non-executing behavior while the embedded instructions push the agent into executing external operations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The execution guidance tells the agent to run commands and generate images but does not present clear just-in-time warnings at the action point about external API use, possible uploads, or side effects. This undermines informed user consent and increases the chance that sensitive content or local file references are sent to third-party services unexpectedly.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to execute a CLI command against a hosted API without requiring a user-facing warning at the point of execution. Because the same document states prompts and local media paths may be sent to external endpoints, failing to surface this before execution can lead to unconsented data transmission or uploads.

Static analysis

No suspicious patterns detected.