skill-my-prose-poem

• Outcome: Pass
• Latest audit: May 28, 2026 · 9:54 AM UTC
• Version: 0.0.1

Overview

This is a diary-writing skill with optional local photo metadata processing; the main risks are disclosed but worth noticing before sharing photos.

Install only if you are comfortable with optional local EXIF processing. Photos can contain hidden timestamps, GPS coordinates, and device details; use the manual fallback if that is sensitive. Leave auto-install disabled if you do not want the skill to fetch Python packages at runtime.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"hint": "Run: pip install -r requirements.txt"
        }
    try:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "--quiet", "pillow>=10.0.0"]
        )
        from PIL import Image as PILImage

• Confidence: 96% confidence
• Finding: The code invokes pip via subprocess to install Pillow at runtime. Although it does not appear to allow direct command injection because arguments are passed as a list, executing package installation from within the skill expands the attack surface, permits unexpected code execution through dependency installation hooks, and performs system modification unrelated to the assistant's stated journaling function.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill invokes shell/Python capabilities to process local image files and optionally install dependencies, yet it declares no permissions. That creates a transparency and least-privilege problem: a user expecting a writing-only skill could unknowingly trigger local file processing and package installation behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared purpose is a prose-writing assistant, but the instructions also direct EXIF extraction, GPS parsing, device metadata collection, image reordering, and optional pip installation. This mismatch is dangerous because it broadens data access and system actions beyond user expectations, increasing the chance of covert privacy exposure and unsafe execution.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: This skill contains subprocess execution and package installation capability that is out of scope for a prose-journal writing assistant. Even if intended as convenience code, the mismatch between declared purpose and actual capabilities makes the skill more dangerous because it can alter the runtime environment and execute external tooling without clear user expectation.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script extracts and returns EXIF metadata including GPS coordinates, timestamps, device make/model, software, and comment fields. In the context of a journaling assistant that claims to ask questions and write without fabrication, collecting and emitting precise location and device metadata is over-privileged and can expose highly sensitive personal information beyond user expectations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger phrases are broad enough to match ordinary conversation, causing the skill to auto-activate in situations where the user may not have intended to invoke it. In an agent ecosystem, overbroad routing can divert unrelated prompts into a skill-specific workflow, leading to unwanted data collection, confusing behavior, or accidental processing of sensitive personal reflections.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The English trigger description lacks clear activation boundaries, which increases the chance of unintended invocation for generic phrases. When a skill can steer the conversation automatically, ambiguity in routing criteria can cause inappropriate collection of user context and reduce the user's ability to control which capability is active.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README states that photo EXIF fields like DateTime, GPSInfo, and Model may be read, but it does not provide a prominent user-facing privacy warning about the sensitivity of that metadata. GPS coordinates and device details can reveal home, workplace, travel history, or personal habits, so silent or poorly disclosed extraction creates a real privacy risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The English documentation mentions EXIF extraction without an explicit warning that metadata may contain sensitive location and device information. Because users often treat photos as content rather than metadata containers, failing to foreground this risk can lead to unintentional disclosure of private information.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The activation rule is extremely broad, covering ordinary requests like journaling, emotion sorting, travel memories, photo-based writing, and daily reflection. Over-broad routing can cause this skill to capture unrelated sensitive personal disclosures by default, especially because it is designed to elicit layered emotional detail.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs EXIF processing and explicitly uses DateTime and GPS data, but provides no privacy warning or explicit consent step. EXIF can reveal location, time, and device information that users often do not realize is embedded in photos, making this a meaningful privacy risk in a seemingly harmless writing workflow.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file is entirely written as Chinese-only style guidance and presents these anchors as direct reference material, which can steer the skill to default to Chinese output regardless of the user's preferred language. In a user-facing writing assistant, this creates a quality and accessibility risk because the model may ignore or override user language expectations, especially when the skill description says it should be broadly triggered for diary-like requests.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Automatic package installation occurs when enabled without any user-facing warning or confirmation in the code path. This can surprise operators, change the environment unexpectedly, and trigger execution of downloaded package code, making it an unsafe pattern especially in a skill whose purpose does not require environment mutation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code parses and outputs sensitive location metadata derived from EXIF without any privacy warning, minimization, or consent gate. GPS coordinates and related location text can reveal where a user lives, travels, or routinely visits, which is especially sensitive in a personal journaling context where users may upload private photos casually.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pillow>=10.0.0

• Confidence: 96% confidence
• Finding: The dependency is specified as `pillow>=10.0.0`, which allows installation of any future major or minor version and makes builds non-reproducible. This increases supply-chain risk because different environments may resolve to different versions, including versions with new vulnerabilities or breaking changes.

Known Vulnerable Dependency: pillow — 10 advisory(ies): CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +7 more

Critical

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The requirement references `pillow` without constraining it away from versions affected by multiple published CVEs, and the broad `>=10.0.0` spec may permit vulnerable releases depending on resolver behavior and deployment timing. Because this skill may process user-provided photos or images as part of diary or memory-writing workflows, image parsing bugs in Pillow can become more relevant, potentially enabling denial of service or, in some versions, more serious exploitation when handling crafted files.

Static analysis

No suspicious patterns detected.