Security audit

Optimize text-to-image prompts for Grok and similar image models, especially for aviation posters, safety campaign visuals, official publicity images, and Chinese-language contest briefs.

Security checks for vulnerabilities and agentic risk

Overview

This is a prompt-writing skill with some Chinese aviation-poster defaults, and it does not run code or request system access.

Installers should know this skill is opinionated toward Chinese/English prompt output and Chinese civil-aviation poster conventions. For non-Chinese or non-aviation use, explicitly tell the agent what language, region, and poster style you want.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The default output format requires a Chinese prompt and an English prompt for every optimization request. This imposes specific language behavior regardless of the user's preferred language, and the file does not state that this is optional or user-selectable.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The file instructs use of 'reserved negative space for Chinese title,' which imposes a specific language requirement in the poster output. The document does not offer any user choice or opt-in for language/locale, so this is a natural-language policy concern under the locale policy rule.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: This template explicitly specifies a 'Chinese headline,' forcing a language choice in generated output. Because the file does not provide an opt-in or alternative locale handling, it violates the language/locale policy criterion.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The template hard-codes 'Chinese civil aviation cabin safety poster,' which implies a specific locale context and associated language/style expectations without user choice. Absent documentation that this is a region-specific skill or that users opt into this locale, this is a policy concern.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The phrase 'clean negative space for Chinese typography' mandates a particular language in output. The file does not indicate that users can choose another language or that the locale restriction is explicitly justified, so it should be flagged.

Static analysis

No suspicious patterns detected.