Security audit

get-net-pic

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate image-downloading purpose, but it can be triggered by ordinary site-opening requests and then fetch arbitrary URLs and write files to the Desktop without clear confirmation or limits.

Install only if you are comfortable with the agent fetching website content, downloading page-referenced images, and creating Desktop files. Use it on public sites you trust, confirm the destination and number of files before running, and avoid internal, authenticated, or sensitive URLs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:19
Finding: Unrestricted URL Fetching Can Access Internal Network Resources
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: 清单描述写明当用户说“登录xxx官网”时触发，暗示技能可执行登录类操作；但同一文件后文限制说明明确表示“只能获取公开可访问的网页资源，无法处理需要登录认证的网站”。这不是单纯描述不完整，而是对技能意图与实际能力的直接冲突，容易让调用方误以为该技能支持登录网站。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to overlap with ordinary browsing intents such as simply opening a website, but the skill performs much more invasive actions: scraping image URLs, downloading files, and preparing local output. This can cause the agent to activate unexpectedly and take side-effecting actions the user did not clearly request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The usage examples define ambiguous activation boundaries, making it easy for routine requests like '打开 XXX 网站' to invoke a workflow that performs scraping and writes files locally. In an agent context, ambiguity around activation materially increases the risk of unintended side effects and user surprise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs downloading arbitrary remote images and saving them to the user's Desktop without an explicit warning or consent checkpoint. Writing unrequested files locally creates privacy, storage, and trust risks, and downloading attacker-controlled content from arbitrary domains broadens exposure to harmful or unexpected files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Generating a DOCX file on the Desktop without explicit notice is a side effect that may not match the user's expectations, especially when triggered from broad phrases. While lower risk than arbitrary code execution, silent local document creation can still lead to confusion, leakage of downloaded content into persistent storage, and unwanted modification of the user's environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The example uses new Date().toLocaleString('zh-CN'), which forces Chinese locale formatting in generated output. This is a natural-language/locale choice imposed by the skill without opt-in or explanation, which can conflict with organizational language or locale policies.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.