微信表情包制作工具

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:27 AM UTC
• Version: 1.0.0

Overview

The skill appears to make WeChat sticker assets as advertised, but it needs Review because it automatically installs unpinned Python packages and can be driven into excessive file/CPU use with unchecked layout values.

Install only if you are comfortable with the skill creating a local Python environment and installing packages from the network. Prefer pinning and reviewing dependencies first, run it in a contained workspace, choose a dedicated output directory, and avoid untrusted images or extreme --layout values; use --remove-bg only when you expect the extra model/runtime processing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/run.sh:31
• Finding: Automatic Installation of Unpinned Third-Party Dependencies## Vulnerability Details **File Location**: `scripts/run.sh:31-32`; `requirements.txt:1-3` **Vulnerability Type**: Supply-chain exposure through unconstrained dependency installation **Risk Level**: High ### Vulnerable Code ```bash log_info "Checking dependencies..." "$PIP_BIN" install -q -r "$REQUIREMENTS_FILE" ``` ```text Pillow>=9.0.0 rembg>=2.0.0 onnxruntime>=1.14.0 ``` ### Technical Analysis The launcher automatically invokes `pip install` whenever the Skill runs. Every dependency uses an open-ended minimum-version constraint rather than an exact version, and the project provides no lockfile, package hashes, or explicit trusted package index. Consequently, the code reviewed during this audit does not fully determine the code that will execute in future runs. Pip may select newer direct dependencies and mutable transitive dependencies published after the audit. Package installation and subsequent imports can execute third-party code under the account running the Skill. This does not prove that the currently named packages are malicious. The vulnerability is the absence of controls that ensure future installations use the reviewed dependency artifacts. ### Attack Path 1. An attacker compromises a permitted package release, one of its transitive dependencies, or the package index/resolution path used by pip. 2. The attacker publishes a release satisfying one of the unbounded `>=` constraints. 3. A user invokes `scripts/run.sh`. 4. The launcher automatically resolves and installs the affected release from the configured pip source. 5. Malicious code executes during package installation, module import, or normal dependency operation. 6. The code runs with the filesystem, network, environment-variable, and process privileges of the user who launched the Skill. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the invoking user's privileges. The attacke ...[truncated 311 chars]
• Remediation: ## Remediation Suggestions 1. Replace open-ended dependency constraints with exact, reviewed versions. 2. Generate a lockfile containing all direct and transitive dependencies. 3. Require cryptographic hashes, for example through pip's `--require-hashes` option and a hash-locked requirements file. 4. Configure an explicit trusted package index or an internally controlled package mirror. 5. Run dependency vulnerability and provenance checks before updating locked versions. 6. Separate environment provisioning from ordinary Skill execution. Do not silently install or upgrade packages every time the image processor runs. 7. Require explicit user approval before network-backed package installation. 8. Consider executing the dependency installation and image processing in a restricted container with minimal filesystem and network access.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/make_stickers.py:68
• Finding: Unbounded Grid Dimensions Permit Denial of Service## Vulnerability Details **File Location**: `scripts/make_stickers.py:68-84, 97-143` **Vulnerability Type**: Missing numeric validation and resource limits **Risk Level**: Medium ### Vulnerable Code ```python if layout_str: try: rows, cols = map(int, layout_str.lower().split("x")) except ValueError: print("Error: Layout must be in format ROWSxCOLS (e.g. 3x3)") sys.exit(1) else: rows, cols = determine_layout(width, height) print(f"Layout: {rows} rows x {cols} cols (Total {rows * cols})") cell_width = width / cols cell_height = height / rows ``` ```python count = 0 total = rows * cols for r in range(rows): for c in range(cols): count += 1 left = c * cell_width upper = r * cell_height right = (c + 1) * cell_width lower = (r + 1) * cell_height box = (left, upper, right, lower) cell = img.crop(box) if remove_bg: if not REMBG_AVAILABLE: print("Error: 'rembg' module missing.") sys.exit(1) try: cell = remove( cell, alpha_matting=True, alpha_matting_foreground_threshold=240, alpha_matting_background_threshold=10, alpha_matting_erode_size=10, ) except Exception as e: print(f"Warning: Failed to remove bg for item {count}: {e}") sticker = cell.resize((240, 240), Image.Resampling.LANCZOS) sticker.save(os.path.join(main_dir, f"{count:02d}.png"), "PNG") icon = cell.resize((50, 50), Image.Resampling.LANCZOS) icon_path = os.path.join(icon_dir, f"{count:02d}.png") icon.save(icon_path, "PNG") ``` ### Technical Analysis The `--layout` argument is parsed as two arbitrary Python integers. The implementation does not en ...[truncated 1895 chars]
• Remediation: ## Remediation Suggestions 1. Require both dimensions to be strictly positive before performing division or creating output directories. 2. Restrict layouts to the documented set, such as `2x3`, `3x2`, `3x3`, `3x4`, and `4x3`, unless additional layouts are explicitly supported. 3. Enforce a conservative maximum total cell count. 4. Reject dimensions that exceed the source image dimensions or would produce unusably small cells. 5. Apply stricter limits when `--remove-bg` is enabled because inference is considerably more expensive. 6. Validate all arguments before creating directories or writing any output. 7. Add tests for zero, negative, malformed, and extremely large dimensions. 8. Consider output-size, execution-time, and disk-quota controls when the Skill processes input from untrusted users. Example validation: ```python allowed_layouts = {(2, 3), (3, 2), (3, 3), (3, 4), (4, 3)} if rows <= 0 or cols <= 0: parser.error("Layout dimensions must be positive.") if (rows, cols) not in allowed_layouts: parser.error("Unsupported layout.") if rows * cols > 12: parser.error("Layout exceeds the maximum sticker count.") ```

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: All user-facing instructions, workflow steps, and invocation examples are written exclusively in Chinese, and the file does not indicate that users may interact in other languages. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale limitation is explicitly justified.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes this skill as automatically cropping 6/9/12-grid source images and converting them into WeChat-compliant sizes. README lines L17-L18 add an optional 'AI background removal' feature using rembg/U2-Net, which is a materially different image-manipulation capability not reflected in the manifest description.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The README presents example invocations like '帮我把它转换成微信表情包素材' and '帮我用这张图生成一份草稿' without defining stricter activation boundaries, exclusions, or required context. Because the skill is invoked via general conversational phrasing, an agent may over-apply this skill to loosely related image-help requests.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs users to run shell scripts that create a virtual environment, install dependencies, download models, and generate output files, but it does not declare any tool scope such as file-write permissions. Missing permission declarations can cause the agent or user to invoke filesystem-modifying behavior without explicit consent boundaries, which weakens least-privilege controls and makes unintended file writes more likely.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code includes natural-language comments and generated output content in Chinese, and later writes Chinese-only template text for users. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The script writes meta.txt and info.txt containing Chinese placeholders and instructions only. Because these are user-facing outputs and the file does not offer an alternative language or justify a mandatory Chinese locale, this conflicts with the language/locale policy.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

parser.add_argument(
        "--remove-bg",
        action="store_true",
        help="Automatically remove background using AI",
    )

    args = parser.parse_args()

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The natural-language content of the skill, including the description and usage instructions, is presented in Chinese only. Under the policy rules, forcing a specific language without user opt-in can be a language/locale policy violation when no alternative or opt-in is offered.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9.0.0
rembg>=2.0.0
onnxruntime>=1.14.0

• Confidence: 94% confidence
• Finding: The dependency is specified with a lower-bound only, which allows future installs to resolve to different versions over time. This weakens reproducibility and may unintentionally introduce vulnerable or breaking releases, especially for an image-processing library with a substantial vulnerability history like Pillow.

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: Pillow has multiple known advisories, and because the manifest does not pin a specific version, there is no reliable way to determine whether deployed environments are using a fixed or vulnerable release. In an image-processing skill, that uncertainty matters more because attacker-controlled image inputs may directly exercise parser bugs and resource-consumption flaws.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9.0.0
rembg>=2.0.0
onnxruntime>=1.14.0

• Confidence: 95% confidence
• Finding: Using rembg with only a minimum version permits installation of arbitrary newer versions, which is risky because this package has a history of security advisories and may pull in complex model/runtime behavior. In a tool that processes user-supplied images, dependency drift can expose the skill to newly introduced server-side, file-handling, or model-loading weaknesses.

Unverifiable Dependency: rembg has 7 known advisory(ies) (CVE-2026-40086 (Rembg has a Path Traversal via Custom Model Loading); GHSA-55v6-g8pm-pw4c (rembg server is vulnerable to Server-Side Request Forgery (SSRF) and a weak defa); CVE-2025-25302 (Rembg CORS misconfiguration) +4 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: rembg has known security advisories, and without a pinned version the deployment could resolve to an affected release without visibility. This is especially concerning here because rembg may involve model loading and file/network-adjacent functionality, increasing the consequences if a vulnerable version is installed in a service that processes untrusted user images.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9.0.0
rembg>=2.0.0
onnxruntime>=1.14.0

• Confidence: 90% confidence
• Finding: onnxruntime is unpinned, so environments may install different builds over time with differing security posture or behavior. Because it executes model-related computation in native code, unexpected upgrades can increase attack surface and make incident response or patch verification difficult.

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The manifest description limits the tool to processing 六宫格、九宫格、十二宫格 source images, but the auto-layout logic explicitly treats near-square images as potentially '2x2 (4宫格)' and the CLI also accepts arbitrary ROWSxCOLS layouts. This makes the implemented scope broader than the stated description, even though the extra capability is not inherently dangerous.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The script automatically runs pip install from requirements.txt when invoked, which can trigger network access and execute package installation logic without explicit user confirmation or prior disclosure. In a skill execution context, this expands the trust boundary to external package sources and can expose users to supply-chain risk if dependencies are compromised or unexpectedly changed.

Static analysis

No suspicious patterns detected.