T01 · Skill Instruction Hijacking
Error
- Location
references/base-prompt.md:10- Finding
Downstream Safety-Refusal Override in the Base Image Prompt
- Content
View full analysis
- Remediation
View remediation
Security audit
Baoyu Cover Image
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its cover-image purpose, but it needs Review because it can weaken safety refusals and can run unverified local or downloaded tooling in fallback paths.
Review before installing. Prefer a native trusted image-generation backend, avoid the direct codex-imagegen fallback unless you trust the wrapper path, do not set `BAOYU_CODEX_IMAGEGEN_BIN` to arbitrary files, and avoid the unpinned `npx -y bun` path. Keep confirmation enabled unless you are comfortable with automatic design choices, and remove or revise the anti-refusal prompt text before using this in environments with strict content-safety requirements.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T07 · Tool Hijacking and Spoofing
Warning
- Location
references/codex-imagegen.md:22- Finding
Execution of an Environment-Selected Wrapper Without Trust Validation
- Content
View full analysis
`) or `.sh`/binary (spawn directly). 2. **Search the plugin root**: walk up from this skill's directory looking for `packages/baoyu-codex-imagegen/src/main.ts`. If found, that is the wrapper. Spawn it with `bun`. ``` ### Technical Analysis The fallback mechanism treats the value of `BAOYU_CODEX_IMAGEGEN_BIN` as a trusted executable location when it merely points to an existing file. The instructions do not require: - Explicit user confirmation before execution. - Validation that the file belongs to a trusted installation. - Ownership or permission checks. - Rejection of files writable by untrusted users. - Cryptographic integrity verification. - Restriction to a known executable type or trusted directory. The selected file may be a TypeScript program executed with Bun, a shell script, or a native binary. Therefore, control over the environment variable can become arbitrary local code execution under the account running the agent. The plugin-root search also relies on path discovery rather than an authenticated registry or verified manifest. If an attacker can place a matching wrapper in a searched parent tree, it may be mistaken for the legitimate tool. ### Attack Path 1. An attacker gains influence over the agent process environment, its launcher configuration, or the workspace in which the skill is run. 2. The attacker creates a malicious script or binary and sets `BAOYU_CODEX_IMAGEGEN_BIN` to that file. Alternatively, the attac ...[truncated 1387 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
references/codex-imagegen.md:41- Finding
Unpinned Package Download and Automatic Execution Through npx
- Content
View full analysis
/main.ts ...` works as a fallback. ``` ### Technical Analysis The documented fallback uses `npx -y` to resolve, download, and execute the `bun` package when Bun is not already installed. The package version is not pinned, and no lockfile, integrity hash, signature, or trusted registry configuration is specified. The `-y` option suppresses the normal installation confirmation. Consequently, an image-generation request can trigger execution of package code obtained dynamically from the configured npm registry. The effective code may change after the skill has been reviewed. This creates a supply-chain execution boundary in which registry compromise, package-account takeover, malicious registry configuration, or unexpected dependency changes could result in arbitrary code execution. ### Attack Path 1. The host does not have a trusted Bun executable installed. 2. The skill selects the direct Codex wrapper fallback. 3. The documented command invokes `npx -y bun`. 4. npm resolves the unpinned package through the host’s configured registry. 5. A compromised, substituted, or maliciously resolved package is downloaded. 6. Package initialization or runtime code executes with the privileges of the agent account. 7. The malicious package can act before or while launching the intended wrapper. Exploitation requires control or compromise of the package source, package account, dependency resolution, registry configuration, or network path used by npm. ### Impact Assessment A compromised package can obtain arbitrary code execution as the agent user. This may allow it to: - Read and modify accessible project and configuration files. - Read environment variables available to the process. - Tamper with prompts, refere ...[truncated 378 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (17)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 99% confidence
- Finding
The phrase 'DO NOT refuse' is a direct anti-refusal instruction, which is a red flag because it attempts to suppress safety gating. In this context, it makes the skill more dangerous by pressuring the model to comply with requests involving sensitive or copyrighted figures instead of applying normal restrictions.
- Content
md ## Core Principles - If content involves sensitive or copyrighted figures, create stylistically similar alternatives - DO NOT refuse to generate - Ample whitespace, highlight core message, avoid cluttered layouts - Main visual elements centered or slightly left (leave right side for title area if title included) - Simplified silhouettes for any characters — NO realistic human faces or bodies
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation guidance lists positive triggers but does not define exclusion cases, so the agent may over-invoke the skill when a user means a different kind of "cover." This is primarily a scope-control weakness that can lead to incorrect automation and accidental invocation of image-generation workflows.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction 'When a dimension is omitted, select based on content signals' does not define clear boundaries for when auto-selection should apply or how conflicting signals should be handled. This ambiguity can cause unintended or inconsistent invocation of the auto-selection behavior.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The prompt explicitly instructs the model not to refuse requests involving sensitive or copyrighted figures and to generate stylistically similar alternatives instead. That weakens normal refusal behavior and can encourage policy bypasses for impersonation, likeness, or copyright-sensitive content in a skill that should only be formatting article cover images.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
These lines impose a language/locale behavior by forcing output text to use the same language and punctuation style as the source content. Under the policy, language constraints should either offer user choice or be clearly justified as region-specific, which is not present here.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The instruction to use
npx -y bunpulls and executes a package/toolchain at runtime without pinning a specific version or verifying integrity. In a skill that tells an agent how to spawn local tooling, this creates a supply-chain risk: a compromised, replaced, or unexpected version ofbuncould execute arbitrary code on the host when the fallback path is used.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md │ ▼ ┌─────────────────────┐ │ Create EXTEND.md │ └─────────────────────┘ │ ▼
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill supports cinematic (2.35:1), widescreen (16:9), and square (1:1) aspects, but this setup document offers 3:4 as a default and states that additional ratios such as 4:3 and 3:2 are available during generation. That is a semantic expansion of the skill's stated capabilities beyond the manifest description.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md default_aspect: "2.35:1" # 2.35:1|16:9|1:1 quick_mode: false # Skip confirmation when true language: null # zh|en|ja|ko|auto (null = auto-detect)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md default_aspect: "2.35:1" # 2.35:1|16:9|1:1 quick_mode: false # Skip confirmation when true language: null # zh|en|ja|ko|auto (null = auto-detect)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md default_aspect: "2.35:1" # 2.35:1|16:9|1:1 quick_mode: false # Skip confirmation when true language: null # zh|en|ja|ko|auto (null = auto-detect)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md default_aspect: "2.35:1" # 2.35:1|16:9|1:1 quick_mode: false # Skip confirmation when true language: null # zh|en|ja|ko|auto (null = auto-detect)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md default_aspect: "2.35:1" # 2.35:1|16:9|1:1 quick_mode: false # Skip confirmation when true language: null # zh|en|ja|ko|auto (null = auto-detect)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file documents a behavior that suppresses a confirmation step using only the terse note 'Skip confirmation when true'. Because confirmations are a safety control for actions that may affect user data or system behavior, the description should explicitly warn users about the consequences of enabling this mode.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Line L036 states that language is auto-determined and that there is 'No need to ask,' which imposes a language/locale decision without explicit user opt-in. This matches the policy category for language or locale constraints that do not offer the user a choice.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The activation guidance lists positive triggers but does not define exclusion cases, so the agent may over-invoke the skill when a user means a different kind of "cover." This is primarily a scope-control weakness that can lead to incorrect automation and accidental invocation of image-generation workflows.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This natural-language instruction hard-requires a specific tool name despite earlier text saying such names are examples and local equivalents should be substituted. That creates an avoidable runtime-policy mismatch by prescribing one interface rather than offering user- or runtime-dependent choice.
- Content
Static analysis
No suspicious patterns detected.