capturas-tutorial-formula100k

• Outcome: Review
• Latest audit: Sep 17, 2026 · 4:08 PM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says, but its renderer handles some user-supplied template fields as raw HTML inside an unsandboxed browser, so users should review it before installing.

Install only if you trust the publisher and are comfortable with local npm dependencies plus Puppeteer rendering. Until the raw-template-field issue is fixed, avoid rendering untrusted manifests or text from third parties, and prefer pinned dependencies with a lockfile.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (26)

Ae1

High

• Category: analysis-evasion

Content

dentro de la carpeta de la skill (evita bajar otro Chrome de ~170 MB) y corre `render.mjs` con `PUPPETEER_EXECUTABLE_PATH=<ruta de tu Chromium>`. Primera insta

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Terminal con comando
node render.mjs --type terminal --out terminal_claude.png \
  --data '{"command":"curl -fsSL https://claude.ai/install.sh | bash"}'

# Paso numerado
node render.mjs --type step --out paso_2.png --bg cream \

• Confidence: 95% confidence
• Finding: The documented example includes `curl -fsSL https://claude.ai/install.sh | bash`, which is a classic remote-script execution pattern. Even though shown as terminal content to render, the presence of this exact command in a skill that also directs shell usage increases the chance an agent or user copies and executes unverified code directly from the network.

External Script Fetching

High

• Category: Supply Chain

Content

- id: r02
    tipo: terminal
    data:
      command: "curl -fsSL https://claude.ai/install.sh | bash"
      title: "Terminal — bash"
      slug: "curl-claude-install"

• Confidence: 95% confidence
• Finding: The manifest example repeats the same remote fetch-and-execute command, normalizing unsafe installation behavior in batch workflows. In context, this is more dangerous because the skill is designed to mass-produce tutorial assets, which can propagate hazardous commands at scale into videos or documents that others may follow blindly.

External Script Fetching

High

• Category: Supply Chain

Content

echo ""
echo "Listo. Ya puedes correr:"
echo "  node $SKILL_DIR/scripts/render.mjs --type terminal --out /tmp/test.png --data '{\"command\":\"curl -fsSL https://claude.ai/install.sh | bash\"}'"

• Confidence: 96% confidence
• Finding: The script prints an example command containing a classic 'curl | bash' pattern, which encourages execution of remote code without prior inspection or integrity verification. Even though the command is shown as example data for rendering, users may copy and run it directly, leading to arbitrary code execution if the remote endpoint is compromised, changed, or spoofed.

External Script Fetching

High

• Category: Supply Chain

Content

Ejemplos:
  # un comando terminal solo
  render.mjs --type terminal --out term.png \\
    --data '{"command":"curl -fsSL https://claude.ai/install.sh | bash"}'

  # un paso numerado
  render.mjs --type step --out step2.png \\

• Confidence: 95% confidence
• Finding: The script includes an example command that pipes a remotely fetched script directly into bash (`curl ... | bash`). Even though it appears in help/example text rather than executed by this file, users may copy-paste it, causing execution of unreviewed remote code whose contents can change at any time or be compromised upstream. In the context of a tutorial-image rendering skill, embedding such a command is more dangerous because the tool is explicitly designed to generate polished instructional assets that can normalize and propagate unsafe operational guidance.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The skill instructs the agent to run `npm install` and shell-based bootstrap/render commands, including package installation, without a strong up-front consent step or clear explanation of execution risk. In an agent setting, silent subprocess and dependency execution can expose the environment to unreviewed code from package registries or local scripts.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The manifest description at L003 says 'NO usa stock' and frames the skill as HTML/CSS/Puppeteer generation of tutorial UI captures. However, the documentation explicitly permits capturing screenshots from websites and requires internet access to fetch Google Fonts, which extends behavior beyond purely local UI rendering and partially contradicts the stated 'no stock' framing.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The HTML root sets `lang="es"`, and the surrounding visible comments/text are also Spanish, which indicates a fixed locale choice. Under the policy criteria, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Missing User Warnings

Low

• Confidence: 72% confidence
• Finding: The file explains that images should be saved in `entregables/capturas/` and later zipped when multiple PNGs are produced. Because this skill description governs behavior that writes output files, an explicit user disclosure about local file creation is expected under SQP-2 unless clearly surfaced as a warning.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": true,
  "type": "module",
  "dependencies": {
    "js-yaml": "^4.1.0",
    "puppeteer": "^23.0.0",
    "sharp": "^0.34.5"
  }

• Confidence: 95% confidence
• Finding: The dependency uses a caret range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newer transitive code over time. This increases supply-chain risk and makes it harder to verify whether deployed code is affected by known vulnerabilities.

Unverifiable Dependency: js-yaml has 11 known advisory(ies) (CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); GHSA-2pr6-76vf-7546 (Denial of Service in js-yaml); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption) +8 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: js-yaml has multiple known advisories, and because the manifest does not pin the exact installed version, it is not possible to verify from this file alone whether a safe or affected release is used. In a skill that likely parses YAML manifests in batch mode, this uncertainty is somewhat more relevant because malicious or malformed YAML could trigger parser issues such as denial of service if an affected version is installed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"type": "module",
  "dependencies": {
    "js-yaml": "^4.1.0",
    "puppeteer": "^23.0.0",
    "sharp": "^0.34.5"
  }
}

• Confidence: 95% confidence
• Finding: Using a non-exact version for puppeteer allows dependency drift between environments and over time. For a package that drives a browser engine, unexpected version changes can alter security posture, behavior, or pull vulnerable/transitively risky releases.

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 75% confidence
• Finding: Puppeteer has at least one historical advisory, and the lack of an exact version means the actual installed release cannot be confirmed from the manifest. The skill context involves rendering HTML to images with a headless browser, so dependency certainty matters, though this specific finding remains low severity because the issue is unverifiability rather than evidence of a known vulnerable installed version.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "js-yaml": "^4.1.0",
    "puppeteer": "^23.0.0",
    "sharp": "^0.34.5"
  }
}

• Confidence: 95% confidence
• Finding: The sharp package is not exactly pinned, so installations may resolve to different versions with different bundled native dependencies. Because sharp includes native/image-processing components, uncontrolled version changes can expose the project to avoidable supply-chain and patch-verification risk.

Unverifiable Dependency: sharp has 4 known advisory(ies) (GHSA-54xq-cgqr-rpm3 (sharp vulnerability in libwebp dependency CVE-2023-4863); GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); CVE-2022-29256 (sharp vulnerable to Command Injection in post-installation over build environmen) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: sharp has known advisories, including native-library inheritance risk, and the unpinned manifest prevents verification of whether the installed build is affected. Because this skill processes and renders images, native image libraries are part of the attack surface, making version ambiguity undesirable even if the manifest alone does not prove exploitability.

Natural-Language Policy Violations

Low

• Confidence: 94% confidence
• Finding: This file contains user-facing comments and output such as "Idempotente", "Falta node", and "Listo" in Spanish, and the script does not indicate that Spanish is an intentional locale-specific requirement. Under the policy, forcing a specific language without user opt-in is a natural-language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This code file embeds user-facing usage instructions, errors, and comments in Spanish only, such as the mode descriptions and flag explanations. That can violate a language/locale policy when the skill forces a specific language without user opt-in or documented regional scope.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: The stylesheet loads fonts from Google Fonts at render time, which introduces an undeclared external network dependency into a Puppeteer-based renderer. This can leak metadata such as IP, timing, and request context to a third party, and it also harms reproducibility and reliability in offline or restricted environments.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The document root sets `lang="es"`, which hard-codes Spanish as the page language. This is a natural-language/locale policy concern because the file does not indicate user opt-in, configurability, or a region-specific justification for forcing that locale.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The template hard-codes `lang="es"`, which enforces a specific language/locale in the rendered output. Under the policy criteria, a fixed locale is a natural-language policy concern when there is no visible opt-in, choice, or justification that the skill is region-specific.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The HTML document sets `lang="es"`, and the visible call-to-action text later is also Spanish, indicating a fixed locale. Under the policy, forcing a specific language without user opt-in or documented region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: The button label `Abrir` is a user-visible string in Spanish with no indication that the skill supports other locales or lets the user choose. This reinforces a fixed-language behavior that conflicts with the language/locale policy when not justified.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The HTML root sets `lang="es"`, which imposes a specific language/locale in the template. Under the policy rules, locale-specific behavior should either offer user choice or be clearly documented as justified for a region-specific use case.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The HTML root element sets `lang="es"`, which hard-codes a Spanish locale for all rendered output. Under the policy rules, forcing a specific language without user opt-in or clear region-specific justification is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 96% confidence
• Finding: The document root sets `lang="es"`, and visible UI strings such as `Paso` are also hardcoded in Spanish. This creates a natural-language locale constraint with no indication of user opt-in or region-specific justification, which matches the policy-violation category for forced language settings.

Static analysis

No suspicious patterns detected.