carrusel-formatos-f100k

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 8:51 PM UTC
• Version: 1.0.3

Overview

This skill is a disclosed Spanish-language carousel planning and rendering toolkit that uses local templates, Chrome, and optional image-generation workflows in ways aligned with its stated purpose.

Installers should be comfortable with a skill that can generate carousel HTML, read image files they point it at, launch local Chrome, and write PNGs into the chosen output folder. Use it only with trusted specs/HTML and photos you intend to include, and confirm any paid image-generation or Telegram delivery step before proceeding.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (72)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a high-level content-generation/router skill for selecting carousel formats and producing writing prompts or HTML. The supplied code instead implements a build pipeline: it reads JSON/HTML input, resolves image paths, injects data into HTML templates, checks for layout/font/image issues, and exports slides as PNGs. This is a materially different primary purpose. While both relate to carousels, the code is an asset renderer/validator, not a format-catalog router or prompt generator.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a content-generation/router skill for carousel formats: it should help choose a format and produce prompt/script/HTML outputs. The supplied code does something materially different: it is a rendering/export tool that reads a local HTML file, launches a browser, finds `.slide` elements, and saves screenshots as PNG files. This is a different primary purpose and includes undeclared filesystem/browser automation behavior. Therefore the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises a high-level content-generation/router skill for choosing among carousel formats and producing ready prompts or HTML. The supplied code does not implement that behavior. Instead, it provides generic rendering and layout support functions used by templates: HTML escaping, lightweight markdown conversion, image/photo rendering, text autofit, asset loading checks, and report generation. These are supporting presentation utilities, not the described business logic. While such utilities could be part of a larger carousel system, this specific code chunk materially differs from the declared primary purpose, so it should be flagged as a mismatch.

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

> - El render a PNG (`build.js` + `export.js`) está hecho para una Mac con Chrome. En el servidor, por defecto entrega el camino **«prompts por plataforma»**: e

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `references/catalogo.md` | Las **37 fichas**: F01–F20 (referencias miradas) y G01–G17. Mecánicas M1–M28, soportes S1–S29, anatomía, error típico, **prompt de

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `references/prompts-por-plataforma.md` | Por ficha: **referencia** (link al post real), **visual detallado** (paleta hex, tipografía, composición por slide) y

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `references/prompts-por-plataforma.md` | Por ficha: **referencia** (link al post real), **visual detallado** (paleta hex, tipografía, composición por slide) y

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `references/prompts-por-plataforma.md` | Por ficha: **referencia** (link al post real), **visual detallado** (paleta hex, tipografía, composición por slide) y

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| `references/grimorio-carruseles.md` | Anatomía completa de los 17 carruseles del Grimorio (G01–G13 + 4 alias). GENERADO por `scripts/sincronizar-grimorio.mjs`

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| F04, F06, F07, F08 · G01 (variante papel) · G06 (variante papel) | esta skill · `templates/papel.html` (F06: stickers con `banana`) |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

| F13 | esta skill · `templates/garabato.html` |

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Chaining Abuse

High

• Category: Tool Misuse

Content

## LAS 17 FICHAS G (lo que la v1 dejó fuera + 2 sumadas el 17-sep)

G01–G13 vienen de la **Guía de Formatos del Grimorio** (carruseles con `soporte: 'carrusel'`); su
anatomía completa vive en `references/grimorio-carruseles.md`, que se regenera con
`scripts/sincronizar-grimorio.mjs` y FALLA si el Grimorio suma un carrusel que aquí no está mapeado.
G14 y G15 son mecánicas que solo vivían dentro de la guía maestra de 25 estilos (estilos 15 y 14).

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly references environment-dependent behavior such as `GEMINI_API_KEY`, `CHROME_PATH`, local Chrome execution, and filesystem paths, yet it declares no tool scope or permission boundary. That creates an unsafe mismatch where an agent may access sensitive environment variables or local resources without a clear least-privilege contract, increasing the risk of accidental secret exposure or unauthorized local execution.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad natural-language phrases such as requests for carousel help or prompts, which can cause the skill to activate unintentionally in ordinary conversation. Over-broad activation increases the chance that the agent will pull in this skill in the wrong context, exposing local rendering behaviors, filesystem assumptions, or side effects the user did not intend.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The instruction "Voz: tuteo siempre ... Nunca voseo" imposes a specific locale/register choice on all outputs. The policy allows locale constraints only when the user is offered a choice or the constraint is clearly justified as region-specific, which is not stated here.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: En L0993 se indica que la guía 'se pasó a tuteo' y que otras variantes siguen con voseo, lo que evidencia una preferencia lingüística prescrita por la skill. Esta clase de restricción de idioma/variante regional entra en conflicto con la política cuando no se ofrece elección u opt-in del usuario.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: El archivo está redactado enteramente en español y presenta el formato e instrucciones como normativa por defecto para la skill. Según la política indicada, forzar un idioma concreto sin opt-in del usuario o justificación regional documentada constituye una violación de política de idioma/locale.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The document sets lang="es", indicating a fixed Spanish-language/locale choice. No surrounding text in the file offers a language option or explains that the skill is intentionally region- or language-specific.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The root HTML element sets `lang="es"`, which signals a fixed Spanish-language locale for the skill output. Under the stated policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Vague Triggers

Low

• Confidence: 78% confidence
• Finding: This is a JSON manifest-style file, so SQP-1 applies. The phrase "Hazme un|carruselito" appears to function like an invocation or activation-style phrase, but it is broad, conversational, and lacks any constraints or negative examples clarifying when it should or should not activate.

Static analysis

No suspicious patterns detected.