Security audit

Baoyu Diagram

Security checks for vulnerabilities and agentic risk

Overview

This diagram skill is purpose-related, but it automatically runs an unpinned runtime/converter and has an inconsistent SVG-only versus PNG output contract.

Install only if you are comfortable with the agent running a local converter and possibly fetching Bun through npm at runtime. Prefer a version that pins its runtime and dependencies, documents PNG output in the manifest, and adds size limits before rasterizing SVGs.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:224
Finding: Unpinned Runtime Execution and Undeclared Native Dependency
Content: View full analysis
[options] ``` Options: - `-s, --scale ` — Scale factor (default: 2) - `-o, --output ` — Custom output path (default: `@2x.png`) - `--json` — JSON output ## Process 1. Identify the diagram type from the user's request 2. Read the relevant reference file if one exists for that type 3. Plan the layout: list all components, determine grouping and flow direction, calculate positions 4. Write the SVG following the layering order above 5. Verify spacing rules — no overlaps, legends outside boundaries, viewBox large enough 6. Save the SVG file 7. Run `${BUN_X} {baseDir}/scripts/main.ts ` to generate @2x PNG 8. Present both files to the user ``` From `scripts/main.ts:41`: ```typescript const sharp = (await import("sharp")).default; ``` ### Technical Analysis The Skill directs the Agent to execute `npx -y bun` when Bun is not already installed. No exact package version, integrity digest, package manifest, or lockfile is provided. Consequently, the package selected from the configured npm registry may change after the Skill has been audited. The conversion script also dynamically imports `sharp`, but the project does not include a dependency manifest or lockfile declaring an audited version. Resolution therefore depends on the runtime and surrounding environment. It may use an unexpected local installation, fail unpredictably, or, in environments supporting automatic package installation, retrieve an unpinned package. This violates reproducible d ...[truncated 1583 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/main.ts:10
Finding: Unbounded SVG Raster Dimensions Permit Resource Exhaustion
Content: View full analysis
= 4 && parts[2] > 0 && parts[3] > 0) return { width: parts[2], height: parts[3] }; } const w = svg.match(/\bwidth\s*=\s*"(\d+(?:\.\d+)?)"/); const h = svg.match(/\bheight\s*=\s*"(\d+(?:\.\d+)?)"/); if (w && h) return { width: Number(w[1]), height: Number(h[1]) }; return null; } ``` From `scripts/main.ts:37-38`: ```typescript const width = Math.round(dims.width * opts.scale); const height = Math.round(dims.height * opts.scale); ``` From `scripts/main.ts:68-72`: ```typescript else if (arg === "-s" || arg === "--scale") { const s = Number(args[++i]); if (isNaN(s) || s <= 0) { console.error(`Invalid scale: ${args[i]}`); return null; } opts.scale = s; } ``` ### Technical Analysis The converter accepts any positive dimensions parsed from the SVG and any positive numeric scale. It does not enforce: - A maximum width or height - A maximum scale - A maximum total pixel count - A maximum SVG input size - Finite-number validation through `Number.isFinite` - A memory or execution-time budget The target raster area grows as `width × height × scale²`. Even moderately large dimensions combined with a large scale can therefore result in very large memory allocations and substantial CPU consumption inside Sharp/libvips. The use of `isNaN` also does not provide a complete finite-number check. Values that become `Infinity` can pass the current positive-value validation, although downstream libraries may reject them rather than allocate an image. ### ...[truncated 1315 chars]
Remediation: View remediation
MAX_SCALE) { throw new Error(`Scale must not exceed ${MAX_SCALE}`); } const width = Math.round(dims.width * opts.scale); const height = Math.round(dims.height * opts.scale); if ( width <= 0 || height <= 0 || width > MAX_DIMENSION || height > MAX_DIMENSION || width * height > MAX_PIXELS ) { throw new Error("Requested raster dimensions exceed safety limits"); } ``` 4. Check the SVG file size before reading and processing it. 5. Configure Sharp/libvips concurrency, cache, and pixel limits where supported. 6. Run conversion with operating-system or container-level memory, CPU, execution-time, and output-size limits. 7. Catch resource-limit errors and return a controlled failure without retrying the same oversized conversion. 8. Add tests covering very large dimensions, extreme scales, `Infinity`, malformed values, and total-pixel boundary conditions. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared description and the code. The description presents a diagram-generation skill for creating many kinds of SVG visualizations from user requests. The code does not generate any diagrams, interpret conceptual/technical content, or render architecture/flow/sequence diagrams. Instead, it only accepts an existing SVG file path, validates that it is an SVG, computes dimensions from viewBox or width/height, and converts the SVG to a PNG file via the sharp library. The primary purpose is materially different, and the output format directly contradicts the claim that output is always a standalone .svg file.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says to use this skill whenever the user asks for 'any kind' of technical or conceptual diagram, any visual representation of structure/logic/process, and includes broad phrases like 'diagram' and 'draw me a ...'. These triggers are vague enough to collide with everyday requests and do not provide exclusion conditions or clear scope boundaries, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.
md
### State Machines Rounded-rect states with double-border for composite states. Filled circle for initial state, bullseye for final state. Curved arrows for self-transitions. Label all transitions with `event [guard] / action` format. ## Output Rules 1. Output a **single `.svg` file** — no external dependencies except the Google Fonts import 2. Set `viewBox` to fit all content with 30px padding; do NOT set fixed `width`/`height` attributes (let the SVG scale responsively)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/structural.md (reported line 11)May include surrounding context.
svg
<g transform="translate(X, Y)">  <rect width="180" height="120" rx="6" fill="#0f172a"/>  <rect width="180" height="120" rx="6" fill="rgba(8,51,68,0.4)" stroke="#22d3ee" stroke-width="1.5"/>

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The implementation writes PNG files via sharp().png().toFile(output), while the skill metadata promises that output is always a standalone SVG file. This mismatch can mislead downstream agents or users into treating raster output as trusted SVG, causing workflow failures, broken security assumptions, or unsafe handling logic based on the declared artifact type.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to create directories/files and execute a script without any user-facing notice or consent step. In an agentic environment, silent filesystem modification and subprocess execution increase the risk of unintended code execution, data placement in sensitive paths, and surprising side effects from ordinary user requests.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs the agent to execute npx -y bun, which fetches and runs an unpinned package/runtime version at execution time. This creates a supply-chain risk: a compromised upstream package, malicious dependency update, or unexpected version change could lead to arbitrary code execution in the agent environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The CLI help explicitly states 'Convert SVG to @2x PNG,' which contradicts the manifest's SVG-only claim and reinforces a deceptive or inconsistent interface contract. In an agent skill ecosystem, contract mismatches are security-relevant because other components may make trust or sanitization decisions based on the declared output format rather than the actual one.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: Line L34 includes multilingual label examples ("Yes" / "No", "True" / "False", "是" / "否") but does not state when each language should be used or that language choice should follow user preference. This can create a locale-policy issue if a skill applies non-user-selected language output by default.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.