Security audit

Content Visual Forge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent visual-asset generation workflow with disclosed source-locking, rendering, and asset-source checks; its network and file-write behavior is purpose-aligned and not hidden.

Install this if you want a Chinese-first visual production workflow for WeChat/Rednote covers, cards, and social visuals. Review source permissions before giving it private documents or URLs, and run the renderer only with trusted local templates/data and an intended output path.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (136)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented purpose says the skill produces visual assets, but the detected behavior includes external web fetching, metadata scraping, and JSON snapshot generation unrelated to direct visual output. This mismatch is dangerous because users and orchestrators may grant trust and invoke the skill under a harmless-looking description while it performs broader data collection and structured extraction, which can bypass review expectations and expand the attack surface.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file contains substantive skill documentation entirely in Chinese, including operational descriptions of capabilities and workflows. Under the language/locale policy rule, presenting skill guidance in a single forced language without offering user choice or documenting a justified locale constraint can violate organizational language policy.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill appears capable of network access and file writing, but the manifest does not declare any explicit tool scope or permission boundaries. When a skill can fetch external content and write artifacts without a constrained allowlist, it increases the chance of overbroad data access, SSRF-style retrieval, unintended exfiltration, or writing files outside the expected output path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The rule "Chinese Legibility First" establishes a language-specific priority in the skill's core hard rules. Because the document does not state that users can choose another language or locale, this can be read as forcing a specific language policy without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All listed triggers and example prompts are presented only in Chinese, indicating the skill is designed to activate and operate in a specific language without offering a language choice or explicit justification. This can violate language/locale policy when users are not given an opt-in or alternative locale path.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase at line 12 is broad enough that ordinary user requests for visual content could activate the skill outside a clearly bounded workflow. Over-broad activation increases the chance of unintended routing, causing the agent to apply this skill to prompts that may require different safeguards, modalities, or user expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This trigger is ambiguous and lacks firm activation boundaries, making it likely to collide with routine requests that are not intended for this specialized skill. Ambiguous routing can lead to inappropriate prompt transformation, unintended file generation, or bypass of other more suitable skills and controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The phrase on line 14 is broad and does not sufficiently constrain the task scope, so many ordinary image-generation or layout requests may match it. In a multi-skill agent environment, this can produce unsafe or incorrect skill selection and expand the attack surface for prompt-routing abuse.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: A vague batch-design trigger can activate on many normal content-production prompts, which weakens the reliability of safe skill boundaries. If triggered inadvertently, the skill may process mixed-source content and generate outputs under assumptions the user did not intend, increasing misuse and policy bypass risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This trigger is too general for safe activation because it can overlap with many harmless style or brainstorming requests that should not necessarily invoke a production-oriented rendering pipeline. Such overlap raises the risk of incorrect tool invocation, unintended content transformations, and weakened separation between exploratory and execution-capable skills.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template is written to generate content specifically for a WeChat public account article cover and uses Chinese instructions throughout, including a requirement that later title placement be suitable for Chinese text. This imposes a specific language/locale assumption without any opt-in or alternative, which matches the policy category for language or locale restrictions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown prompt is written entirely in Chinese and explicitly requires Chinese text output, including '不要生成任何中文文字' except for the main title and subtitle. That imposes a language/locale constraint without any visible user opt-in or documented region-specific justification, which matches the policy-violation category for forced language choices.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prompt text is entirely in Chinese and instructs the model to perform the review in that language context, but it does not provide any user opt-in, alternative language option, or justification for a mandatory Chinese locale. This matches the policy category for language or locale constraints imposed through natural-language instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prompt defines the assistant role and required tasks entirely in Chinese, including explicit requirements for Chinese title layout. This imposes a specific language/locale behavior without offering the user a choice or explaining a justified regional constraint, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The notes section uses normative language in Chinese, including '必须', and does not provide any user opt-in or alternative locale handling. This can violate language/locale policy because the template imposes a specific language context rather than offering a choice or documenting a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This JSON includes user-facing descriptive text and a prompt template entirely in Chinese, but provides no indication that the user can choose another language or that the skill is intentionally region-specific. That can violate a language/locale policy requiring user opt-in before forcing a specific language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown template presents all user-facing instructions and field labels in Chinese, which effectively forces a specific language for use. The file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose, so it conflicts with the policy against imposing a language without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The template explicitly requires 'a Chinese educational infographic' and later states 'Chinese text must be short, clear, and legible,' which imposes a specific language/locale. Under the policy, forcing a language without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown template uses Chinese section headings and instructions throughout, which effectively forces a specific language for users of the skill. The policy allows language constraints only when the skill offers user opt-in or clearly documents a justified locale-specific scope, neither of which is present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Several eval prompts and expected outputs are written to require Chinese-language interaction or responses, but the file does not indicate that this locale restriction is optional or limited to a justified region-specific mode. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The manifest description is written only in Chinese and describes generation of WeChat-publication visuals, while the risk controls explicitly prioritize Chinese legibility. This indicates a language/locale constraint that is imposed by default, but the manifest does not offer any user language choice or explain a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The risk_controls entry chinese_legibility_first establishes a Chinese-language presentation preference as a built-in rule. Because the manifest does not describe any opt-in, alternative locale support, or explicit regional scoping, this appears to violate the language/locale choice requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document is written entirely in Chinese, including headings and operational descriptions, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, a language constraint without opt-in or clear justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file's instructional content is primarily written in Chinese and presents mandatory behavior without any indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the constraint is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The policy states that background assets must not interfere with the readability of Chinese titles/body text, which implies a fixed language expectation. Under the language/locale policy rule, forcing a specific language is a violation unless the skill offers user choice or clearly documents a justified locale constraint.
Content: No source excerpt is available for this finding.