T08 · Insecure Dependencies
Warning
- Location
README.en.md:123- Finding
Unpinned npx Installer Executes Mutable Third-Party Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Generate professional social
Security checks for vulnerabilities and agentic risk
Overview
This skill is mainly a social-poster generator with expected local rendering and asset-sourcing behavior, but installation and external fetching should be reviewed first.
Before installing, review the exact npx/git commands and prefer a pinned commit or trusted package version. During use, confirm before letting the agent fetch online images, fonts, or maps, and avoid putting private locations or real API tokens into generated HTML.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Note
- Location
references/map-component.md:50- Finding
Map Rendering Guidance Permits Arbitrary Unpinned npm Packages
- Content
View full analysis
img` child. Quality is lower than Mapbox, so keep labels sparse and let HTML pins carry the useful text. ``` ### Technical Analysis The instructions recommend using the `staticmaps` npm package “or similar” without specifying: - An exact package identity or trusted publisher. - A reviewed version. - An integrity hash. - An approved alternative-package list. - A requirement to update the project lockfile before execution. The phrase “or similar” permits an agent or user to select an arbitrary package based on search results or package-name resemblance. This increases exposure to dependency confusion, typo-squatting, abandoned packages, and malicious install scripts. No malicious map dependency is currently present in `package.json` or `package-lock.json`; the risk arises when these instructions are followed and an additional dependency is selected dynamically. ### Attack Path 1. A task requires a real map but no Mapbox token is available. 2. The agent follows the Mode O instructions and searches for `staticmaps` or a similar npm package. 3. It selects an unreviewed, typo-squatted, compromised, or malicious substitute. 4. The package is installed without an exact version or integrity verification. 5. npm executes any applicable package lifecycle scripts, or the application imports and runs malicious runtime code. 6. The package performs unauthorized actions using the permissions and accessible data of the invoking user. ### Impact Assessment The maximum impact is code executio ...[truncated 616 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (56)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md 2. **Style & Theme** — 选 Editorial 还是 Swiss,再从 10 套预设里选主题色。不允许自定义 hex 3. **Layout Selection** — 根据内容结构从 28 个版式骨架里挑、粘、改文案。Editorial 16 个 / Swiss 12 个 4. **Asset Prep** — 取图(Unsplash / Pexels / Flickr CC / Wallhaven / 直接搜索),落本地 + 写 `SOURCES.md`;问用户要不要标来源 5. **Compose & Render** — 拷种子模板 → 替换 `<!-- POSTERS_HERE -->` → `node render.mjs` 6. **Deliver & Review** — 先把 PNG 给用户看,询问"你自己看还是我先帮你跑 validator",默认不自动核查 7. **Iterate** — 用户提反馈,改 inline 样式或 swap 版式 / 替图,重渲
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md 2. **Style & Theme** — 选 Editorial 还是 Swiss,再从 10 套预设里选主题色。不允许自定义 hex 3. **Layout Selection** — 根据内容结构从 28 个版式骨架里挑、粘、改文案。Editorial 16 个 / Swiss 12 个 4. **Asset Prep** — 取图(Unsplash / Pexels / Flickr CC / Wallhaven / 直接搜索),落本地 + 写 `SOURCES.md`;问用户要不要标来源 5. **Compose & Render** — 拷种子模板 → 替换 `<!-- POSTERS_HERE -->` → `node render.mjs` 6. **Deliver & Review** — 先把 PNG 给用户看,询问"你自己看还是我先帮你跑 validator",默认不自动核查 7. **Iterate** — 用户提反馈,改 inline 样式或 swap 版式 / 替图,重渲
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 7. **QA** — Run `validate-social-deck.mjs` (optional)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md - **Content shape**: For single film: cover (title + year + 1-line take) → 1-2 scene captures → director-quote / theme pullquote → verdict ledger. For weekly: matrix of 6-9 films + one hero recommendation. - **Pitfalls**: 1. **Fake film-festival typography** — adding fake awards badges. Don't. 2. **Spoiler in title without warning.** If a cover gives away the ending, mark `剧透` in the kicker. ---
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <section class="poster xhs" id="cover-image-led"> <!-- subject map (cover hero — example: Yading lake at dawn): primary focus: snow peak at 50% x 32% y (middle band) safe text zone: top band (0-12% y) low-detail sky, bottom band (72-95% y) calm water reflection
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html </head> <body> <!-- ==================== 海报 1: 21:9 头图 ==================== --> <div class="poster wide" id="poster-1"> <div class="content"> <div class="label-tag">XI'AN CULTURAL TOURISM</div>
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This handoff file presents all operational instructions, warnings, and workflow details only in Chinese. Under the policy rule for language/locale, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document content is written entirely in Chinese and explicitly states where the facts are documented, but nowhere in this file does it offer users or maintainers a language/locale choice. Under the policy rule, forcing a specific language without opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises an image sourcing workflow that downloads content from multiple external services and writes local files, but it does not foreground a clear user-facing warning at the point of use. In agent contexts, silent network access and file creation can surprise users, create privacy/compliance issues, and increase exposure to untrusted remote content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The installation instructions direct an AI agent to create directories under the user's home directory and clone a repository there without an explicit warning that this modifies the filesystem. That can lead to unexpected persistence and trust boundary issues, especially when pasted into autonomous agents with shell access.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The instructions create a persistent installation under
~/.claude/skills/, which survives the current session and can affect future agent behavior through auto-detection/triggering. Persistence increases risk because a one-time action changes later sessions, potentially causing unexpected activation or continued trust in code that was cloned earlier.- Content
md > Install the `guizang-social-card-skill` Claude Code skill for me. Steps: > > 1. Make sure `~/.claude/skills/` exists (create if not) > 2. Run `git clone https://github.com/op7418/guizang-social-card-skill.git ~/.claude/skills/guizang-social-card-skill` > 3. Verify: `ls ~/.claude/skills/guizang-social-card-skill/` should show `SKILL.md`, `assets/`, `references/` > 4. Tell me when done. Later, saying things like "make me a Xiaohongshu carousel" will trigger this skill.
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough to overlap with normal design-assistance requests, which can cause the skill to activate in situations the user did not specifically intend. In an agent environment with shell, network, and filesystem access, unintended activation matters because the skill's workflow includes external image sourcing, local downloads, and rendering steps.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly tells users to hand shell commands to an AI agent with filesystem access, including cloning into
~/.claude/skills/and later updating viagit pull, without warning that this causes code execution and local file modification. In an agent setting, normalizing blind shell delegation is risky because users may authorize commands they do not review, increasing the chance of unintended code retrieval, persistence, or modification.- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md > > 1. 确保 `~/.claude/skills/` 目录存在(不存在就创建) > 2. 执行 `git clone https://github.com/op7418/guizang-social-card-skill.git ~/.claude/skills/guizang-social-card-skill` > 3. 验证:`ls ~/.claude/skills/guizang-social-card-skill/` 应该看到 `SKILL.md`、`assets/`、`references/` 三项 > 4. 告诉我装好了,之后我说"做一套小红书图文"之类的话就会触发这个 skill 把这段话复制粘贴给 Claude Code / Cursor / 任何有 shell 权限的 AI Agent,它会自动完成安装。
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md > > 1. 确保 `~/.claude/skills/` 目录存在(不存在就创建) > 2. 执行 `git clone https://github.com/op7418/guizang-social-card-skill.git ~/.claude/skills/guizang-social-card-skill` > 3. 验证:`ls ~/.claude/skills/guizang-social-card-skill/` 应该看到 `SKILL.md`、`assets/`、`references/` 三项 > 4. 告诉我装好了,之后我说"做一套小红书图文"之类的话就会触发这个 skill 把这段话复制粘贴给 Claude Code / Cursor / 任何有 shell 权限的 AI Agent,它会自动完成安装。
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Claiming that any shell-enabled AI agent will automatically complete installation encourages users to delegate repository cloning and setup without understanding the resulting local changes. In the context of agent skills, this weakens the review boundary and can make downstream execution of untrusted skill content more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The workflow explicitly instructs sourcing images from third-party providers and rendering files locally, but does not disclose trust, licensing, privacy, or filesystem implications. That can lead users or downstream agents to fetch untrusted external content and create local output files without informed consent, increasing risk of data handling mistakes, policy violations, or unsafe file operations in automated environments.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The markdown provides invocation examples like '帮我基于这篇文章做一套瑞士风小红书图文' and '做一个西安文旅的杂志风海报' as the primary way to use the skill, but it does not define whether these are exact trigger phrases, examples only, or what requests should not activate the skill. Because the description also says 'or any visual content needing high-quality rendering,' the trigger scope is quite broad and may overlap with ordinary creative requests.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Lines L062-L074 prescribe special handling for Chinese titles as a default content rule, and similar Chinese-specific defaults appear elsewhere in the file. This is a natural-language locale constraint that does not provide user opt-in or explain that the skill is intentionally limited to a Chinese-language publishing context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The recipe specifies the section title as "3-6 Chinese characters," which imposes a language-specific requirement in natural-language guidance. Elsewhere the file mixes English and Chinese examples, but this line presents Chinese as mandatory rather than optional or context-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The instruction "each <= 6 Chinese characters" is a hard locale-specific constraint embedded in the skill guidance. Because the file does not frame this as an opt-in for Chinese-language content, it can force a specific language/locale behavior contrary to the policy.
- Content
Static analysis
No suspicious patterns detected.