Security audit

图片姬

Security checks for vulnerabilities and agentic risk

Overview

This is mainly an image-prompt writing skill, but it asks for file editing authority that is not needed for that purpose.

Review this before installing because the skill asks for file Write/Edit access even though it mainly generates prompt text. A safer version would remove or tightly scope those permissions; otherwise, use it only in workspaces where accidental file changes would be acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill behavior is narrowly scoped to generating Chinese CS-education visualization poster prompts, while the manifest describes a general-purpose image prompt generator. This mismatch can mislead users and orchestrators into invoking the skill in contexts it is not designed for, causing unintended outputs, policy bypass assumptions, or incorrect trust decisions about capability and scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger terms are very broad and cover generic image-prompt, illustration, style-customization, and visual-design requests without clear boundaries. This can cause the skill to activate in unintended contexts, increasing the chance it overrides more appropriate skills or injects unsolicited formatting/instructions into unrelated tasks.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L030 明确将技能定位为仅输出结构化 Prompt 的生成器，给人的预期是围绕用户输入进行本地化分析与组织；但 L349-L352 又要求 AI 自主“搜索/分析主体背景资料”，这引入了额外的信息获取行为，与前述纯生成器定位存在直接意图层面的冲突。这里不是单纯实现细节缺失，而是文档中对技能边界的表述彼此不一致。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill defaults to Chinese output when the user has not specified a language. While not a direct security flaw, this is a prompt-scope/control issue because it can override user expectations and cause unintended disclosure, misunderstanding, or poor interoperability in downstream workflows that assume another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instruction requiring Chinese output by default removes user choice and may override the caller's expected language behavior without consent. In multi-skill or automated environments, this can cause usability failures, downstream processing errors, or confusion when the surrounding system expects another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file includes a natural-language style directive, "Japanese清新 illustration style," that imposes a locale/cultural style choice in the generated output. Under the policy, language or locale constraints should either be user-selected or clearly justified; here, the file presents the constraint as fixed rather than optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Line L59 explicitly requires "日系清新插画风" and "吉卜力工作室式自然美学," which is a locale/cultural style requirement expressed as mandatory natural-language guidance. Because the file does not offer alternatives or explain a region-specific need, this matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. Multiple prompt blocks explicitly require Chinese-language output or mix English framing with Chinese-only content, but nowhere in the file is a user opt-in or alternative language choice offered.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown reference is written entirely in Chinese and does not indicate that other languages are supported or that Chinese is a user-selectable locale. Under the policy rule for natural-language constraints, a skill that effectively requires a specific language without opt-in can be a locale-policy issue.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.