T08 · Insecure Dependencies
Warning
- Location
SKILL.md:13- Finding
Unpinned Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
GlucoDNA 广告图生成器
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but it handles a Gemini API key through a shared workspace file in a way users should review before installing.
Review this skill before installing. Prefer providing a dedicated, restricted GEMINI_API_KEY through a protected environment or secret manager, avoid storing live keys in TOOLS.md, run it in a virtual environment with reviewed dependency versions, and confirm where generated files should be saved.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
generate.py:13- Finding
Plaintext API-Key Discovery in a Shared Workspace Document
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script searches a workspace file (TOOLS.md) for a live Gemini API key and extracts it with a regex, which is a form of credential harvesting from local project data unrelated to the core ad-generation logic. This creates unauthorized access to sensitive credentials and expands the skill's privileges beyond what a user would reasonably expect from an image generator.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The file explicitly instructs collection of personal data including name, shipping address, and phone number for order fulfillment, but provides no guidance on consent, minimization, storage, retention, or secure handling. In a sales/support skill that may be used by agents or automations, this increases the risk of unnecessary exposure, informal copying, or insecure downstream processing of customer PII.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The code comment understates the behavior as 'reading Gemini key from TOOLS.md', but the implementation actively scans file contents with a regex to recover a usable API credential. That mismatch is dangerous because it conceals sensitive-file parsing behavior, making code review and user consent less effective.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script accesses a local file likely to contain operational secrets and does so silently, without warning or consent. In the context of a skill whose visible purpose is ad image generation, undisclosed credential access is unexpected and increases the risk of secret exposure or misuse.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The embedded prompt explicitly instructs the model to generate a Chinese advertisement and render Chinese text, but the script provides no option for another language or opt-in to this locale restriction. That is a natural-language locale policy issue under the stated rule because the language is imposed by default.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This file presents all product, sales, and usage guidance in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill explicitly states it will save output to the user's desktop, but does not mention any confirmation, opt-in, or configurable output path. While this is not inherently severe, writing files to a user-visible system location without clear consent can cause unwanted side effects, clutter, and reduced user control over local file creation.
- Content