Snapdesign Rednote Clean

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:08 AM UTC
• Version: 2.0.2

Overview

The skill mostly matches its image-card purpose, but it asks for an unexplained API key and adds fixed BaoAI branding and engagement content without clear user control.

Review before installing. Use this only if you are comfortable with a Chinese RedNote/Xiaohongshu card workflow that may add BaoAI branding and engagement prompts. Do not place a real API key in TOOLS.md; require the publisher to explain or remove the LibTV/Liblib credential requirement, and consider disabling external Google Fonts or using local fonts for confidential content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:186

Finding

Mandatory Third-Party Branding and Engagement Injection

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 186–196; corroborated by line 365
Vulnerability Type: Mandatory output manipulation through Skill instructions
Risk Level: Medium

Complete Evidence Snippet

The following is an English translation of the relevant source instructions:

text

Each image set must end with a final slide that directs users to follow, save, or comment.

[Content area]
  - Eyebrow text
  - Divider
  - Closing title
  - Summary text
  - Call to action
  - Brand signature: BaoAI, aligned to the right

Quality-control requirement:
  - Footer left: page number in "01 / N" format
  - Footer right: "BaoAI" watermark

Technical Analysis

The Skill imposes output requirements that are not inherently necessary to perform its stated image-layout function. In particular, it directs the Agent to add an engagement-oriented call-to-action slide and repeatedly requires the fixed third-party BaoAI brand in the generated material.

Because these instructions are loaded as part of the Skill workflow, an Agent following them will modify user deliverables even when the user did not request promotional content or third-party branding. This is a form of instruction-level output hijacking: the Skill introduces an additional promotional objective alongside the user's formatting objective.

The issue does not grant operating-system privileges or permit code execution. Its scope is the Agent's generated content and the trust relationship between the user and the Agent.

Attack Path

1. A user invokes the Skill to convert supplied material into RedNote images.
2. The Agent loads and follows the mandatory workflow in SKILL.md.
3. The workflow adds a final slide encouraging follows, saves, or comments.
4. The Agent places the BaoAI signature or watermark into the generated slides.
5. The branded deliverables are sent to the user without an explicit user request for ...[truncated 593 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory BaoAI signature and footer watermark from the default templates and quality-control checklist.
2. Do not add engagement calls to action unless the user explicitly requests them.
3. Introduce an optional branding parameter that defaults to no branding.
4. Permit only branding supplied or affirmatively approved by the user.
5. Present a clear preview or disclosure before adding promotional material to deliverables.
6. Add a quality-control requirement confirming that no unrequested trademarks, watermarks, calls to action, or attribution have been inserted.

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:5

Finding

Unsafe Recommendation to Store an API Credential in a Documentation File

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5–11
Vulnerability Type: Insecure credential-storage guidance
Risk Level: Low

Complete Evidence Snippet

The following is an English translation of the relevant source instructions:

markdown

## Configuration

1. After installation, add your API configuration to TOOLS.md.
2. Alternatively, set an environment variable at runtime.

## API Configuration

This Skill requires the following environment variable:
- LIBTV_ACCESS_KEY - LibTV API key

Technical Analysis

The README advises users to place API configuration in TOOLS.md, but it does not distinguish non-sensitive configuration from the LIBTV_ACCESS_KEY secret. It also provides no requirements for file permissions, source-control exclusion, log redaction, secret rotation, or use of a dedicated secret manager.

A documentation file is liable to be committed to source control, included in support bundles, indexed by development tools, or exposed to an Agent as ordinary project context. If a user follows the instruction by writing the API key into that file, the credential may be disclosed to unintended parties.

The documented image-generation workflow in SKILL.md does not explain why the LibTV credential is required, creating an additional inconsistency that may cause users to configure an unnecessary secret.

Attack Path

1. A user follows the README configuration instructions.
2. The user writes LIBTV_ACCESS_KEY and its value into TOOLS.md.
3. The file is committed, shared, logged, archived, or loaded into an Agent context.
4. An unauthorized party obtains the plaintext API key.
5. The party uses the key against the associated LibTV account, subject to the permissions and quotas assigned to that credential.

Impact Assessment

The maximum impact is limited by the privileges granted to the exposed API key. Possible consequences include unauthorized API reque ...[truncated 347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to store API credentials in TOOLS.md.
2. Require runtime secret injection through a dedicated secret manager or protected environment variable.
3. Document that secret values must never be committed to source control, included in prompts, or written to logs.
4. Provide an example using only a placeholder, such as LIBTV_ACCESS_KEY=<secret>.
5. Add relevant secret-bearing files to .gitignore and enforce restrictive file permissions where local secret files are unavoidable.
6. Validate whether the LibTV API is actually required by this Skill; remove the credential requirement if it is unused.
7. Recommend scoped, revocable credentials and document rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger conditions are very broad and require immediate invocation on common user phrases, which can cause the skill to activate without clear user intent or contextual confirmation. In agent environments, overbroad auto-invocation can bypass safer routing, cause unintended file generation or networked rendering steps, and increase the chance of handling sensitive user content without explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README uses Chinese throughout and does not indicate that the skill is region-specific or provide any user opt-in for language preference. This can violate language/locale policy when users are expected to understand setup and safety-relevant instructions but are forced into a single language.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to provide a LibTV/Liblib API key even though the skill’s stated purpose is narrow content/layout generation for Xiaohongshu knowledge cards and does not disclose any need for a third-party service. This creates an unjustified credential collection path and can mislead operators into granting external access they did not expect, increasing data exfiltration and supply-chain risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation introduces an undeclared third-party API integration that is not justified by the manifest’s described functionality. Hidden or poorly documented external integrations are dangerous because they expand the trust boundary, may transmit user content to outside services, and prevent reviewers from accurately assessing the skill’s behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description and formatting instructions are written as mandatory Chinese Xiaohongshu output, with Chinese fonts and Chinese filename/content conventions throughout. There is no opt-in or explicit statement that the skill is limited to Chinese-language output for a region-specific use case, which makes the locale constraint appear mandatory by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs saving generated PNGs to local storage and sending them to the user without any disclosure about local persistence, retention, or cleanup. If the input article contains confidential business information, this creates unnecessary data-at-rest exposure and raises the risk of accidental retention or cross-task access on shared systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill loads Google Fonts from a third-party service, creating an outbound network request during rendering that may leak metadata such as usage timing, IP, and possibly document-associated context. In a sandboxed or privacy-sensitive environment, undisclosed external fetches are risky because users may assume purely local rendering while their content workflow triggers third-party contact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L337-L338 明确写着“直接发送图片，不需要打包 ZIP”，但后续 L340 与 L342 仍在执行 zf.write(...) 和打印 ZIP ready，与注释宣称的行为直接矛盾。这不是单纯信息不完整，而是文档意图与代码动作相反，容易误导实现者。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L036 声称“不输出 HTML 文件”，但 L042 明确要求“生成 HTML 并导出为 PNG”，示例代码在 L313、L329 也实际从 HTML_PATH 加载本地 HTML 截图。虽然 HTML 可能只是中间产物，但当前表述会让人误解为流程完全不涉及 HTML。

Content

No source excerpt is available for this finding.