clonador-carrusel-formula100k

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 8:48 PM UTC
• Version: 1.0.1

Overview

This skill is a purpose-aligned carousel creation workflow, with privacy-relevant external fetching that users should approve knowingly.

Before installing, confirm you are comfortable with Instagram or TikTok links being processed through Apify or other scraping services, downloaded media being stored in session/output folders, Google Fonts being loaded during rendering, and optional user photos being referenced from local workspace paths. Do not use it for private or sensitive posts unless you provide screenshots yourself, and review copyright/platform-term implications before cloning a third-party visual style.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill promises scraping, visual analysis, content transformation, and rendering, but the detectable implementation appears limited to exporting HTML via a headless browser. This mismatch is dangerous because operators may trust the documented behavior while hidden or missing logic is handled elsewhere, weakening reviewability and enabling undeclared processing or unsafe operator assumptions.

Ae1

High

• Category: analysis-evasion

Content

Seguir la receta de **`references/descargar-referencia.md`**. En resumen:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

Seguir la receta de **`references/descargar-referencia.md`**. En resumen:

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence
• Finding: The skill describes use of environment-dependent execution paths and external tooling, but it does not declare a tool scope or permissions boundary. That creates an authorization gap where an agent may invoke networked or local capabilities more broadly than a reviewer or runtime expects, increasing the chance of unintended data access or execution.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The metadata says to activate 'SIEMPRE' for a wide range of cloning and imitation requests, which is an overly broad trigger. Broad activation increases the chance the skill runs in contexts the user did not clearly intend, potentially causing unsolicited scraping, file access, or third-party style replication workflows.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The activation section includes a catch-all rule for 'any screenshot or link' with intent to reproduce a look, which is ambiguous and expansive. In practice this can cause the skill to engage on loosely related prompts and initiate third-party content retrieval or processing without sufficiently bounded consent.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs automatic downloading of Instagram/TikTok post images through Apify and direct URL fetching, but only mentions cost in passing and does not require a clear consent prompt about network transmission or third-party processing. This can expose user-supplied links and related metadata to external services and may surprise users who did not expect outbound data sharing.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The provided skill manifest describes a broader capability: taking screenshots or Instagram/TikTok links, extracting a reference carousel's style DNA, improving it, and rendering a branded carousel. In this file, the package describes only rendering carousel scripts to PNG using a preset FORMULA 100K brandkit, which omits the cloning/extraction behavior and instead suggests a narrower render-only implementation.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This file contains user-facing instructions exclusively in Spanish, and there is no indication that the skill is intentionally limited to Spanish-speaking users or a Spanish-language workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to fetch third-party Instagram/TikTok content via Apify and curl, save it to temporary storage, and process it without first informing the user that external services will be contacted and files will be stored locally in the session scratch space. This creates a privacy and data-handling risk, especially if links are private, sensitive, or copyrighted, because user-provided URLs and downloaded media may be disclosed to external processors and retained transiently without explicit consent.

Natural-Language Policy Violations

Low

• Confidence: 98% confidence
• Finding: The instruction mandates 'Español neutro en todo texto entregado (tú, no vos)' as a fixed language/locale policy. This forces a specific locale variant without offering the user a choice or documenting a justified regional constraint.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: The file’s user-facing natural-language strings and documentation are written only in Spanish, including the usage instructions and output description. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"export": "node export.js"
  },
  "dependencies": {
    "puppeteer-core": "^24.42.0"
  }
}

• Confidence: 86% confidence
• Finding: Using a caret range for puppeteer-core allows automatic adoption of future minor/patch releases, which can introduce supply-chain risk, unexpected behavior changes, or newly exposed attack surface without deliberate review. In this skill's context, the dependency is used for headless browser rendering, so silent dependency changes can materially affect a component that processes untrusted visual/web content.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: El atributo `lang="es"` impone una configuración de idioma específica en la plantilla. No se documenta que sea una plantilla regional ni se ofrece al usuario la opción de ajustar el locale, lo que encaja con una posible violación de política de idioma/locale.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: La plantilla incluye una hoja de estilos de Google Fonts, lo que provoca una conexión saliente automática al renderizar el HTML y filtra metadatos como IP, user agent y momento de acceso a un tercero. En un flujo que usa Chromium headless para procesar contenido generado, esto introduce dependencia de red y una filtración de privacidad no explicitada al usuario.

Static analysis

No suspicious patterns detected.