Security audit

Screenshots

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent screenshot-making workflow, but it keeps persistent user preference and feedback notes in the home directory without clear consent, retention, or deletion controls.

Review before installing if you share the machine or work on confidential apps. The skill may create ~/screenshots, keep reusable memories and learnings across sessions, and store per-user or verbatim feedback unless the agent is instructed not to. Consider using it only with non-sensitive screenshots or asking the agent to disable persistent learning and delete ~/screenshots/memory.md and ~/screenshots/learnings.md when finished.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill persists preferences under `~/screenshots/` and instructs creation of that directory without clearly warning the user that local files will be created and retained across sessions. Persistent storage of style history and learned patterns can expose user or project information, especially on shared systems or when users assume the interaction is ephemeral.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The instruction to read `~/screenshots/memory.md` "on activation" creates ambiguous implicit behavior around when the skill accesses persistent user data. In an agent context, unclear activation scope can cause the skill to read local files without an explicit user request or informed consent, increasing privacy risk and making it harder to reason about data access boundaries.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly instructs persistent storage of per-user names, preferences, and behavioral notes in a shared markdown file without any data minimization, consent, access control, or retention limits. Even if intended for personalization, this creates a privacy and disclosure risk because personal data can accumulate, be reused outside user expectations, or be exposed to other users, operators, or future prompts.

Ssd 3

Medium

Confidence: 93% confidence
Finding: These instructions tell the agent to retain user preference notes and project feedback in a persistent natural-language file, which can easily capture more personal or sensitive context than necessary and later resurface it in unrelated interactions. Because the storage format is free-form markdown, it is especially prone to over-collection, accidental disclosure, and prompt-time leakage.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The instruction to record explicit user feedback verbatim creates a direct path for storing sensitive or unnecessary user-provided content, including names, business details, complaints, or other confidential information. Verbatim retention increases the chance that exact private text is later revealed, searched, or fed back into future model context without the user's intent.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: This markdown workflow directs creation of organized output folders and deliverables, and earlier phases define versioned screenshot directories, but it does not warn the user that running the workflow will create and potentially replace local files in the specified paths. For a markdown skill, user-facing documentation should disclose filesystem effects when the process affects user data or project artifacts.

Static analysis

No suspicious patterns detected.