Security audit

Text-to-Carousel

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward carousel-image generator that uses Gemini and optional user content sources, with no evidence of hidden persistence, destructive actions, or deceptive behavior.

Before installing, understand that generated prompts, slide text, and any attached product image may be sent to Google's Gemini API, and any article or WordPress URL you ask it to use may be fetched. Avoid using private internal URLs or confidential images unless that sharing is acceptable.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read local files such as TOOLS.md and reference files and to perform outbound network requests to fetch URLs and call the Gemini API, but it declares no explicit tool scope or permission boundary. That creates an ambient-authority problem where the runtime may grant broader file and network access than users expect, increasing the chance of unintended data exposure or unauthorized external requests.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The invocation description includes generic phrases like "create slides," "make social media graphics," and "generate carousel from text," which could match many ordinary user requests outside this skill's intended scope. The description does not provide exclusion conditions or clearer boundaries for when the skill should or should not activate.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to fetch article URLs and WordPress posts without explicit warnings, consent boundaries, or origin restrictions. This can lead to unreviewed outbound requests to attacker-controlled URLs, privacy leaks through URL fetching, and possible retrieval of sensitive internal resources if the environment has broader network reach than intended.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The instruction 'The Chinese characters must be exactly' imposes a specific language requirement in the prompt template. This is a natural-language locale policy concern because the file does not present Chinese as optional, user-selected, or justified as a region-specific requirement.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The line requires all Chinese text to be reproduced exactly, which enforces a locale-specific output format. Because the document does not indicate that Chinese is optional or limited to a justified regional use case, this conflicts with the language/locale policy guidance.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The word 'Always' establishes a default policy that prompts should include exact Chinese text requirements, regardless of user choice. This is broader than a documented regional constraint and therefore represents a natural-language locale policy violation.

Static analysis

No suspicious patterns detected.