Security audit

Card News Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill can generate Instagram card images, but it also hardcodes a specific account brand, includes credential-backed posting and Telegram sharing steps, and ships an unsafe JPEG conversion script.

Review this skill before installing. Only use it if you want the hardcoded @lio_universe_00 branding, are comfortable with Instagram or Telegram publishing steps, and can avoid or fix the unsafe --jpeg conversion path. Prefer removing the fixed handle, requiring explicit upload confirmation, vendoring fonts locally, and replacing execSync with a non-shell API.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:42
Finding: Forced Third-Party Branding and Promotional Content Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/screenshot.js:17
Finding: OS Command Injection Through the JPEG Output Directory
Content: View full analysis
!a.startsWith('-') && !a.endsWith('.html')) || 'output'; const useJpeg = args.includes('--jpeg'); ``` ```javascript const filePath = path.join(outputDir, `${name}.${ext}`); if (useJpeg) { // Screenshot as PNG first, then convert const pngPath = path.join(outputDir, `${name}.png`); await cards[i].screenshot({ path: pngPath }); const { execSync } = require('child_process'); execSync(`sips -s format jpeg -s formatOptions 90 "${pngPath}" --out "${filePath}" 2>/dev/null`); fs.unlinkSync(pngPath); } ``` ### Technical Analysis The output directory is taken directly from a command-line argument and incorporated into `pngPath` and `filePath`. Those paths are then interpolated into a command string passed to `child_process.execSync()`. `execSync()` executes the string through a shell. Although the paths are surrounded by double quotes, an attacker can include a double quote and shell metacharacters in the output-directory argument. This can terminate the quoted path and append another shell command. The issue is reachable only when the `--jpeg` option is used. The PNG-only branch does not invoke the shell. For example, a malicious output-directory value shaped like the following can introduce shell syntax: ```text out"; injected-command; # ``` The exact payload can be adapted to use commands available on the host. The script also creates the attacker-supplied directory before conversion, so characters that are meaningful to the shell can remain embedded in the path until the vulnerable command is executed. ### Attack Path 1. The attacker gains control over, or influences, the arguments used to invoke `screenshot.js`. 2. The attacker provides a valid HTML file, enables `--jpeg`, and supplies an output-directory argu ...[truncated 1167 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: assets/dark-editorial.css:4
Finding: Unpinned Remote Stylesheet Loaded During Browser Rendering
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

Category: Privilege Escalation
Confidence: 91% confidence
Finding: Referencing a local .env file in an automated posting flow indicates access to stored credentials for an external service. In the context of a content-generation skill, this broadens capability from local file creation to credential-backed account actions, increasing the risk of unauthorized posting, misuse of tokens, or accidental exposure of secrets through logs or downstream tooling.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
bash
cd /Users/gyeuun/.openclaw/workspace/skills/instagram-content-studio node scripts/post-image.js \ --env .env \ --caption '캡션 텍스트' \ ./output/cover.jpg ./output/card_1.jpg ...

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill’s declared purpose is card-news/image generation, but the documented workflow expands into external Instagram posting via a separate skill. That creates an unnecessary data-transfer boundary and can cause generated content, captions, and local files to be sent to third-party services without clear user consent or scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes API-based Instagram upload using a local .env file but provides no user-facing warning that credentials will be accessed and content will be transmitted externally. This violates least surprise and can lead to silent use of stored secrets and unintended publication or data disclosure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Including Telegram-based transmission as a fallback introduces an unrelated exfiltration path that is not necessary for generating card-news images. Even if intended for manual operations, it enables content and potentially sensitive business material to be routed through an external messaging platform without defined safeguards.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code builds a shell command with interpolated file paths and executes it via execSync. Although the output names are internally derived, the output directory is user-controlled, so shell metacharacters in that path can trigger command injection when JPEG mode is used. In this skill context, processing user-supplied HTML already expands the attack surface, making shelling out for image conversion more dangerous than necessary.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The stylesheet imports a font directly from jsDelivr, which creates a runtime dependency on a third-party network resource. In a screenshot-generation skill, this can leak request metadata, reduce reproducibility, and allow build/render failures or unintended content changes if the remote asset becomes unavailable or is modified upstream.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Loading a remote font without disclosure is a real privacy and transparency issue because rendering this CSS causes an external request that users or operators may not expect. In this skill's context, the risk is limited but still relevant because automated Playwright-based rendering may occur in backend environments where hidden network egress is undesirable.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This code invokes a system subprocess via execSync to run sips, which is a safety-relevant operation for code files under the missing-warning rule. Although there is an internal comment describing the conversion step, there is no user-facing disclosure at runtime or prompt indicating that an external system command will be executed.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/screenshot.js:48