Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly does what it says, but its renderer handles some user-supplied template fields as raw HTML inside an unsandboxed browser, so users should review it before installing.
Install only if you trust the publisher and are comfortable with local npm dependencies plus Puppeteer rendering. Until the raw-template-field issue is fixed, avoid rendering untrusted manifests or text from third parties, and prefer pinned dependencies with a lockfile.
Referenced artifact was not completely inspected
dentro de la carpeta de la skill (evita bajar otro Chrome de ~170 MB) y corre `render.mjs` con `PUPPETEER_EXECUTABLE_PATH=<ruta de tu Chromium>`. Primera insta
The documented example includes curl -fsSL https://claude.ai/install.sh | bash, which is a classic remote-script execution pattern. Even though shown as terminal content to render, the presence of this exact command in a skill that also directs shell usage increases the chance an agent or user copies and executes unverified code directly from the network.
# Terminal con comando
node render.mjs --type terminal --out terminal_claude.png \
--data '{"command":"curl -fsSL https://claude.ai/install.sh | bash"}'
# Paso numerado
node render.mjs --type step --out paso_2.png --bg cream \
The manifest example repeats the same remote fetch-and-execute command, normalizing unsafe installation behavior in batch workflows. In context, this is more dangerous because the skill is designed to mass-produce tutorial assets, which can propagate hazardous commands at scale into videos or documents that others may follow blindly.
- id: r02
tipo: terminal
data:
command: "curl -fsSL https://claude.ai/install.sh | bash"
title: "Terminal — bash"
slug: "curl-claude-install"
The script prints an example command containing a classic 'curl | bash' pattern, which encourages execution of remote code without prior inspection or integrity verification. Even though the command is shown as example data for rendering, users may copy and run it directly, leading to arbitrary code execution if the remote endpoint is compromised, changed, or spoofed.
echo ""
echo "Listo. Ya puedes correr:"
echo " node $SKILL_DIR/scripts/render.mjs --type terminal --out /tmp/test.png --data '{\"command\":\"curl -fsSL https://claude.ai/install.sh | bash\"}'"
The script includes an example command that pipes a remotely fetched script directly into bash (curl ... | bash). Even though it appears in help/example text rather than executed by this file, users may copy-paste it, causing execution of unreviewed remote code whose contents can change at any time or be compromised upstream. In the context of a tutorial-image rendering skill, embedding such a command is more dangerous because the tool is explicitly designed to generate polished instructional assets that can normalize and propagate unsafe operational guidance.
Ejemplos:
# un comando terminal solo
render.mjs --type terminal --out term.png \\
--data '{"command":"curl -fsSL https://claude.ai/install.sh | bash"}'
# un paso numerado
render.mjs --type step --out step2.png \\
The skill instructs the agent to run npm install and shell-based bootstrap/render commands, including package installation, without a strong up-front consent step or clear explanation of execution risk. In an agent setting, silent subprocess and dependency execution can expose the environment to unreviewed code from package registries or local scripts.
The manifest description at L003 says 'NO usa stock' and frames the skill as HTML/CSS/Puppeteer generation of tutorial UI captures. However, the documentation explicitly permits capturing screenshots from websites and requires internet access to fetch Google Fonts, which extends behavior beyond purely local UI rendering and partially contradicts the stated 'no stock' framing.
The HTML root sets lang="es", and the surrounding visible comments/text are also Spanish, which indicates a fixed locale choice. Under the policy criteria, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
The file explains that images should be saved in entregables/capturas/ and later zipped when multiple PNGs are produced. Because this skill description governs behavior that writes output files, an explicit user disclosure about local file creation is expected under SQP-2 unless clearly surfaced as a warning.
The dependency uses a caret range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newer transitive code over time. This increases supply-chain risk and makes it harder to verify whether deployed code is affected by known vulnerabilities.
"private": true,
"type": "module",
"dependencies": {
"js-yaml": "^4.1.0",
"puppeteer": "^23.0.0",
"sharp": "^0.34.5"
}
js-yaml has multiple known advisories, and because the manifest does not pin the exact installed version, it is not possible to verify from this file alone whether a safe or affected release is used. In a skill that likely parses YAML manifests in batch mode, this uncertainty is somewhat more relevant because malicious or malformed YAML could trigger parser issues such as denial of service if an affected version is installed.
Using a non-exact version for puppeteer allows dependency drift between environments and over time. For a package that drives a browser engine, unexpected version changes can alter security posture, behavior, or pull vulnerable/transitively risky releases.
"type": "module",
"dependencies": {
"js-yaml": "^4.1.0",
"puppeteer": "^23.0.0",
"sharp": "^0.34.5"
}
}
Puppeteer has at least one historical advisory, and the lack of an exact version means the actual installed release cannot be confirmed from the manifest. The skill context involves rendering HTML to images with a headless browser, so dependency certainty matters, though this specific finding remains low severity because the issue is unverifiability rather than evidence of a known vulnerable installed version.
The sharp package is not exactly pinned, so installations may resolve to different versions with different bundled native dependencies. Because sharp includes native/image-processing components, uncontrolled version changes can expose the project to avoidable supply-chain and patch-verification risk.
"dependencies": {
"js-yaml": "^4.1.0",
"puppeteer": "^23.0.0",
"sharp": "^0.34.5"
}
}
sharp has known advisories, including native-library inheritance risk, and the unpinned manifest prevents verification of whether the installed build is affected. Because this skill processes and renders images, native image libraries are part of the attack surface, making version ambiguity undesirable even if the manifest alone does not prove exploitability.
This file contains user-facing comments and output such as "Idempotente", "Falta node", and "Listo" in Spanish, and the script does not indicate that Spanish is an intentional locale-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.
This code file embeds user-facing usage instructions, errors, and comments in Spanish only, such as the mode descriptions and flag explanations. That can violate a language/locale policy when the skill forces a specific language without user opt-in or documented regional scope.
The stylesheet loads fonts from Google Fonts at render time, which introduces an undeclared external network dependency into a Puppeteer-based renderer. This can leak metadata such as IP, timing, and request context to a third party, and it also harms reproducibility and reliability in offline or restricted environments.
The document root sets lang="es", which hard-codes Spanish as the page language. This is a natural-language/locale policy concern because the file does not indicate user opt-in, configurability, or a region-specific justification for forcing that locale.
The template hard-codes lang="es", which enforces a specific language/locale in the rendered output. Under the policy criteria, a fixed locale is a natural-language policy concern when there is no visible opt-in, choice, or justification that the skill is region-specific.
The HTML document sets lang="es", and the visible call-to-action text later is also Spanish, indicating a fixed locale. Under the policy, forcing a specific language without user opt-in or documented region-specific justification is a natural-language policy violation.
The button label Abrir is a user-visible string in Spanish with no indication that the skill supports other locales or lets the user choose. This reinforces a fixed-language behavior that conflicts with the language/locale policy when not justified.
The HTML root sets lang="es", which imposes a specific language/locale in the template. Under the policy rules, locale-specific behavior should either offer user choice or be clearly documented as justified for a region-specific use case.
The HTML root element sets lang="es", which hard-codes a Spanish locale for all rendered output. Under the policy rules, forcing a specific language without user opt-in or clear region-specific justification is a natural-language policy violation.
The document root sets lang="es", and visible UI strings such as Paso are also hardcoded in Spanish. This creates a natural-language locale constraint with no indication of user opt-in or region-specific justification, which matches the policy-violation category for forced language settings.