Security audit

boceto-a-animacion-f100k

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed sketch-to-animation workflow that uses Higgsfield and local deliverable files, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Installers should be comfortable with sending user sketches to Higgsfield and spending account credits only after explicit approval. The publisher should clarify the composition section so users do not expect server-side split/reveal assembly in this package.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The main documentation says the skill 'llega hasta el .mp4 y lo compone: clip suelto, split «Animación | Boceto» y revelado', implying end-to-end composition. But the same file later states this server version does not run composition and only delivers the clip, frames, sketch, and prompts, leaving split/reveal assembly to CapCut or Edits.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: Paso 11 is labeled 'NO corre en este servidor', yet it still provides executable bash commands to run the compositor as part of the process. This directly conflicts with the earlier OpenClaw-specific guidance that `scripts/componer.py` is not included in this version and that composition should be done manually in CapCut or Edits.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The template explicitly requires the generated prompts to be written 'en inglés', which imposes a language choice on the user-facing workflow. The file does not offer an alternative language option or explain why English is mandatory for policy or regional reasons, so this is a natural-language locale policy violation.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This section indicates the skill's real or expected workflow differs from the declared one by 'correcting' an implementation that always uses the sketch as the first frame. Such semantic drift is a genuine integrity issue: users and calling systems may believe the skill behaves one way, but internal guidance instructs another, which can cause incorrect automation decisions and undermine trust in the skill contract.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation explicitly says the original skill 'always takes the sketch as the first frame,' which contradicts the manifest's claim that the system decides whether the sketch is the initial or final frame. This kind of instruction/behavior mismatch is dangerous because downstream agents or operators may rely on the manifest for safety and correctness, while the actual reference guide drives a different workflow that can silently produce misleading or degraded outputs.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The instruction states "Los prompts van en inglés" because models obey better, which imposes a language choice rather than offering the user a locale option. This matches a natural-language policy violation because the file mandates a specific language without opt-in or a documented region-specific justification.

Static analysis

No suspicious patterns detected.