Security audit

Repo

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate WeChat cover-image generator, with some activation and installation cautions but no evidence of hidden or harmful behavior.

Install from a trusted reviewed source where possible, avoid mutable URL imports when you need reproducibility, and be explicit when invoking the skill because some trigger phrases are generic. Before running it in sensitive project folders, confirm the article path and output directory, and avoid feeding unusually large or untrusted image files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: README.md:26
Finding: Mutable Repository Import and Unpinned Pillow Dependency
Content: View full analysis
Remediation: View remediation
\ --hash=sha256: ``` Install it with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Automate dependency vulnerability scanning and controlled lock-file updates. 6. Document the exact repository commit and dependency lock revision covered by each security review. 7. Where supported, verify signed Git commits or release artifacts before enabling the Skill. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/make_cover.py:204
Finding: Unbounded Image Decoding Can Cause Resource Exhaustion
Content: View full analysis
Remediation: View remediation
MAX_WIDTH or height > MAX_HEIGHT or width * height > MAX_PIXELS ): raise ValueError("Input image dimensions exceed the permitted limit") src = candidate.convert("RGB") ``` 3. Configure Pillow decompression-bomb warnings as errors rather than silently continuing: ```python import warnings from PIL import Image, ImageFile warnings.simplefilter("error", Image.DecompressionBombWarning) ``` 4. Keep Pillow’s decompression-bomb pixel limit enabled and set it explicitly according to expected 1:1 source images. 5. Run image processing inside a worker with memory, CPU, and wall-clock limits. 6. Accept only explicitly supported image formats and handle malformed-image exceptions without retry loops. 7. Close source images deterministically by using context managers. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises very broad trigger phrases such as asking to make a cover, design a cover image, or use the skill by name in normal conversation. In agent platforms that rely on natural-language matching, this can cause the skill to activate unintentionally on unrelated user content, leading to unwanted file access, image-generation actions, or resource consumption.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation text includes many broad, common phrases such as '设计封面', '封面图', and 'article cover' style terms without clear exclusion boundaries, which can cause the skill to trigger in contexts beyond WeChat public-account cover generation. Overbroad triggering is dangerous because it can hijack unrelated user requests, causing unintended file reads, image generation, and workflow execution under the wrong skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list is broad and includes generic phrases like '封面图', '文章配图', and '设计封面', which can overlap with ordinary user requests that do not clearly intend to invoke this specific skill. In an agent environment, this increases the chance of unintended activation, causing the skill to access files and generate outputs when the user did not explicitly request this workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that the agent '自动执行完整工作流，输出到文章所在目录', meaning it writes files automatically into the user's workspace without an explicit warning or confirmation step. In a context with filesystem access, this can lead to unintended file creation, overwriting of existing assets, or side effects in sensitive project directories if the wrong article or path is in scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger list includes broad Chinese phrases such as “封面图”, “文章配图”, and “设计封面”, which are common requests that may appear in unrelated contexts. This can cause unintended auto-activation of a skill that has filesystem access and image-generation capabilities, increasing the chance of accidental data exposure or unnecessary file modifications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The English trigger phrase “cover image” is highly generic and overlaps with everyday design, publishing, and documentation requests. In this skill, unintended invocation is more concerning because the skill is configured for filesystem read/write and image processing, so a generic phrase can activate privileged behavior outside the intended WeChat-cover use case.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Line L086 states "no English" as a blanket constraint in the generated asset instructions. This is a natural-language locale restriction, and the file does not explicitly present it as an opt-in user preference or clearly justify it as a mandatory region-specific policy.
Content: No source excerpt is available for this finding.