Security audit

Content Visual Forge

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent visual-asset generator; its file rendering, source processing, and optional external asset use are disclosed and aligned with that purpose.

Install if you want a Chinese-oriented visual content production workflow. Before using production rendering, check that any external images, logos, screenshots, or URLs are authorized and recorded, and avoid rendering untrusted custom HTML/templates because the Playwright renderer can load remote resources referenced by the render package.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill advertises a documentation-only visual generation workflow, but the referenced behavior indicates undeclared file write and network capabilities. Hidden or undeclared capabilities weaken least-privilege guarantees and can enable unexpected data egress or local persistence when processing user-supplied PDFs, webpages, screenshots, or transcripts.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a true transparency and trust-boundary issue: the skill claims to transform content into visual assets, but also performs external fetching, scraping of style-atlas metadata, and URL provenance enforcement not clearly disclosed in its primary behavior. That mismatch is dangerous because users may provide sensitive source material assuming local processing, while the skill may contact third-party infrastructure and persist metadata without informed consent.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: This renderer loads attacker-influenced HTML in a real browser and calls page.goto() without any request interception or network restrictions, so any <img>, CSS, font, script, or other remote resource referenced by the template or injected data can trigger outbound HTTP(S) requests during rendering. The existing asset_source_record checks only cover a few structured fields in the JSON payload and do not prevent arbitrary remote fetches embedded directly in the HTML template or in untracked attributes/styles, creating SSRF-style egress, internal network probing, and privacy leakage risk.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrase is broad enough to match routine requests for generic visualizations, which can cause the skill to activate outside its intended scope. In an agent-routing system, overbroad activation can hijack user intent, invoke unnecessary processing paths, and increase the chance that untrusted external content is pulled into rendering workflows without clear user consent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The phrase for style exploration is ambiguous and does not constrain output mode, safety boundaries, or user intent. That ambiguity can lead to incorrect skill selection and unintended execution of rendering or asset-generation logic, though the impact is lower than direct code or data exposure issues.

Natural-Language Policy Violations

High

Confidence: 91% confidence
Finding: The manifest is structured around Chinese-language interaction and examples without giving users an explicit language-choice mechanism or documenting why that restriction is required. In practice, this can cause misrouting, misunderstanding of safety instructions, and exclusion of users or downstream systems that expect other languages, especially when the skill is auto-invoked from generic prompts.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The eval at this line uses a very generic trigger phrase ('做一张公众号封面，要好看就行，你随便发挥') that can activate the skill with minimal context. In a routing system that relies on natural-language activation, broad phrasing increases the chance of unintended invocation and may bypass the intended Source Lock gate unless downstream safeguards are consistently enforced.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file is written entirely in Chinese and defines output structure and operating guidance without any indication that the skill should preserve the user's language or that Chinese is a required locale. In a multi-language agent environment, this can cause unexpected language switching, reduce usability, and create safety/compliance issues if users cannot reliably understand generated content or review factual boundaries.

Natural-Language Policy Violations

Medium

Confidence: 81% confidence
Finding: The checklist explicitly requires checking Chinese readability, which can hard-code a locale expectation into the workflow and bias the skill toward Chinese output even when user preference differs. In a content-generation pipeline this can cause incorrect-language deliverables, reduced usability, and inadvertent mishandling of multilingual requests, though the impact is operational rather than a direct security compromise.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The rule 'Chinese Legibility First' hard-codes a language preference into output behavior without requiring the agent to ask for or honor the user's language choice. In a multilingual skill, this can cause incorrect or inaccessible output, especially when rendering text assets where language fidelity and readability are core requirements.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The rule makes "生成图片" default to preview mode, which is a very common and underspecified request. In this skill, users are explicitly asking for publishable visual assets, so silently routing broad requests to a non-final mode can cause the system to generate outputs that violate quality, readability, or commercial-delivery constraints without making that limitation clear.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The production trigger relies on a short list of ambiguous keywords such as "正式 / 发布 / 商用 / 最终", which may miss many real production-intent requests or be misapplied out of context. In a visual-production skill intended for public-facing cover assets, weak activation criteria can cause the agent to choose the wrong pipeline and bypass stricter production quality gates when they are actually needed.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The rule hard-codes Chinese-specific rendering behavior ('中文小字') and implies a Chinese-only output strategy without offering a language choice or fallback path. In a user-facing content-generation skill, this can cause exclusion, incorrect outputs for non-Chinese requests, and silent language coercion that may violate user expectations or accessibility requirements.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The workflow content is written entirely in Chinese and prescribes analysis/output behavior without indicating any mechanism to honor the user's language preference. This can cause the agent to respond in an unintended language, reducing usability and potentially causing misunderstanding of safety-critical constraints or source fidelity requirements.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The rule '小字号中文默认不交给图像模型' hard-codes Chinese-specific behavior without any indication that the user's language or locale was requested first. While this is not a direct security exploit, it can override user intent, create inconsistent output behavior, and act as an unsafe policy constraint embedded in the skill rather than derived from explicit user preference.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The workflow hard-codes Chinese text requirements for generated prompts and page copy, such as requiring Chinese text strategy and Chinese layout assumptions, without indicating this should depend on the user's requested language. In an agent setting, this can override user intent, reduce usability for non-Chinese audiences, and cause unauthorized transformation of content language in downstream assets.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.