reimagine-it

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:18 AM UTC
• Version: 2.3.1

Overview

This is a broad creative redesign skill with disclosed file-output behavior and no evidence of hidden theft, backdoors, or destructive intent.

Before installing, pin the skill source and any optional Python packages where possible, use a constrained environment for package installs, and confirm before letting the skill edit existing project files in place.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Skill Installation from a Mutable Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

text

Agent Skill. Install with npx skills add Kayforkind/reimagine-it,

Technical Analysis

The installation command identifies a mutable repository target without pinning a reviewed release, tag, commit hash, or package integrity value. If the repository, associated account, installation utility, or dependency chain is compromised after review, the command may retrieve content different from what was audited.

Because package installation can execute installation hooks or make downloaded Skill instructions available to an Agent, the effective behavior can change without a corresponding change to this reviewed artifact. The dependency is related to the Skill’s declared installation process, but the mutable reference unnecessarily expands the supply-chain trust boundary.

Attack Path

1. An attacker compromises the referenced repository, its maintainer account, or a dependency involved in the npx skills installation flow.
2. The attacker publishes a malicious revision under the same mutable repository name.
3. A user executes npx skills add Kayforkind/reimagine-it.
4. The installer retrieves the attacker-controlled revision rather than the audited content.
5. Malicious installation behavior or Skill instructions execute with the permissions available to the invoking user or Agent.

Impact Assessment

A successful compromise could modify files accessible to the invoking process, read workspace or environment data, and alter subsequent Agent behavior. The exact scope depends on the permissions granted to the package runner and Agent host. No evidence shows that the currently audited repository itself performs such malicious actions; the risk arises from the unpinned retrieval path.

Remediation

View remediation

Remediation Suggestions

• Pin installation to an immutable, reviewed release or commit hash.
• Publish and document checksums or other integrity metadata for release artifacts.
• Require explicit user approval before running package installation commands.
• Review the resolved dependency tree and installation scripts before execution.
• Run installation with minimal filesystem and environment access.
• Document a verified release-based command instead of a mutable repository reference.

T08 · Insecure Dependencies

Warning

• Location: references/forms/document.md:20

Finding

Unpinned python-docx Installation

Content

View full analysis

Vulnerability Details

File Location: references/forms/document.md:20
Vulnerability Type: Unpinned Python dependency installation
Risk Level: Medium

Vulnerable Code

text

Install: `pip install python-docx`.

Technical Analysis

This command installs the latest package version selected by the configured Python package index. It does not specify an exact version, verify hashes, use a lockfile, require an isolated environment, or establish an explicit user-confirmation gate.

Python package installation and subsequent imports execute third-party code with the privileges of the Agent process. A compromised upstream release, package index account, dependency, or index configuration could therefore introduce code that was not included in this audit.

Attack Path

1. An attacker compromises the python-docx release channel, one of its dependencies, or the package index used by the environment.
2. A malicious version becomes the version resolved by the unpinned command.
3. The Agent follows the documentation and runs pip install python-docx.
4. Attacker-controlled installation or runtime code executes when the package is installed or imported.
5. The payload accesses resources available to the Agent process.

Impact Assessment

Potential impact includes reading workspace files and process-accessible environment data, modifying generated or source files, and executing additional local commands under the invoking user’s permissions. No malicious behavior was found in the audited Skill itself; this finding concerns the mutable dependency resolution process.

Remediation

View remediation

Remediation Suggestions

• Pin python-docx to an exact reviewed version.
• Supply a hash-locked requirements file and install with:

  bash

  python -m pip install --require-hashes -r requirements.txt
  

• Create and use a dedicated virtual environment.
• Ask the user before installing missing dependencies.
• Prefer an already-installed, verified package when available.
• Restrict package indexes to explicitly trusted sources.

T08 · Insecure Dependencies

Warning

• Location: references/forms/pdf.md:15

Finding

Unpinned WeasyPrint Installation

Content

View full analysis

Vulnerability Details

File Location: references/forms/pdf.md:15
Vulnerability Type: Unpinned Python dependency installation
Risk Level: Medium

Vulnerable Code

text

Install: `pip install weasyprint`. Note: Weasyprint on Windows needs GTK — see [weasyprint install docs](https://doc.courtbouillon.org/weasyprint/stable/first_steps.html). If GTK is unavailable, fall back to Path B.

Technical Analysis

The command resolves and installs a mutable latest version without an exact version, lockfile, package hashes, isolated-environment requirement, or explicit approval step. WeasyPrint also relies on a broader rendering and native-library ecosystem, increasing the number of upstream components included in the trust boundary.

The documentation URL is a normal reference and was not found to transmit workspace data. The vulnerability is the unpinned installation command, not the presence of the hyperlink.

Attack Path

1. An attacker compromises the WeasyPrint package, one of its transitive dependencies, or the configured package index.
2. The compromised release becomes the version selected by pip.
3. The Agent runs the documented command.
4. Malicious installation or import-time code executes with the Agent’s local permissions.
5. The payload may access workspace content or modify local files.

Impact Assessment

Successful exploitation could provide code execution under the invoking user’s account, exposing files and environment data available to the Agent and allowing local file modification. The impact is limited by process sandboxing and operating-system permissions. The audited repository contains no evidence that it intentionally exploits this path.

Remediation

View remediation

Remediation Suggestions

• Pin WeasyPrint and all transitive dependencies to reviewed versions.
• Use hash verification through a locked requirements file.
• Document compatible, verified GTK/native-library versions where applicable.
• Install in a dedicated virtual environment or constrained container.
• Require explicit approval before installing packages or native libraries.
• Prefer an existing verified local renderer and fail safely when unavailable.

T08 · Insecure Dependencies

Warning

• Location: references/forms/pdf.md:26

Finding

Unpinned ReportLab Installation

Content

View full analysis

Vulnerability Details

File Location: references/forms/pdf.md:26
Vulnerability Type: Unpinned Python dependency installation
Risk Level: Medium

Vulnerable Code

text

Install: `pip install reportlab`.

Technical Analysis

The command installs whichever ReportLab version the configured package index currently resolves. It provides no version pin, integrity hash, dependency lock, environment isolation, or confirmation gate.

Installation and later import of a compromised package could execute code with the same filesystem and environment access as the Agent. Although ReportLab is relevant to the declared PDF-generation function, automatically trusting an unreviewed latest release exceeds the minimum dependency privilege needed for reproducible document generation.

Attack Path

1. An attacker compromises the ReportLab distribution channel, package index account, or a transitive dependency.
2. The unpinned command resolves to the compromised release.
3. The Agent installs or imports the malicious package.
4. Attacker-controlled code runs under the Agent process.
5. The code accesses or modifies resources permitted to that process.

Impact Assessment

Potential privileges are those of the invoking user or Agent sandbox. Possible effects include local code execution, workspace data access, environment-data exposure, and modification of files. No malicious ReportLab package or intentional exploitation was observed during this static audit.

Remediation

View remediation

Remediation Suggestions

• Pin ReportLab to an exact reviewed version.
• Verify package hashes and use a dependency lockfile.
• Install into a dedicated virtual environment.
• Obtain explicit user approval before installation.
• Use only trusted package indexes.
• Record the reviewed version and expected hashes in the Skill package.

T08 · Insecure Dependencies

Warning

• Location: references/forms/slides.md:21

Finding

Unpinned python-pptx Installation

Content

View full analysis

Vulnerability Details

File Location: references/forms/slides.md:21
Vulnerability Type: Unpinned Python dependency installation
Risk Level: Medium

Vulnerable Code

text

Install: `pip install python-pptx`.

Technical Analysis

This instruction installs a mutable latest package version without a lockfile, exact version, integrity hash, isolated environment, or explicit confirmation. Any compromise of the package, its dependencies, or the configured package index could replace the expected slide-generation library with attacker-controlled code.

The dependency supports the Skill’s declared slide-generation functionality, but unrestricted installation under the Agent’s identity creates an avoidable supply-chain execution path.

Attack Path

1. An attacker compromises the python-pptx package, one of its dependencies, or the selected package index.
2. The malicious release becomes the version resolved by the unpinned command.
3. The Agent runs pip install python-pptx.
4. Malicious installation or import-time behavior executes locally.
5. The payload uses the Agent process’s available filesystem and environment permissions.

Impact Assessment

Exploitation could permit local code execution, workspace file access, environment-data exposure, and modification of generated or existing files within the invoking process’s permissions. There is no evidence of embedded malicious code in the audited project; the exposure is caused by unsafe dependency acquisition.

Remediation

View remediation

Remediation Suggestions

• Pin python-pptx and its dependencies to reviewed versions.
• Use hash-verified dependency files.
• Install inside a dedicated virtual environment or container.
• Require explicit user consent before installing missing tooling.
• Prefer verified packages already present in the environment.
• Restrict resolution to trusted package indexes and retain an auditable lockfile.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises broad natural-language triggers such as reimagine it, reinvent this, redesign this page, and make an infographic, which are common phrases that can appear in ordinary user requests. In agent ecosystems with automatic skill routing, such broad triggers can cause unintended invocation on arbitrary files or repos, expanding the skill's authority and causing unreviewed file reads/writes or workflow changes without the user's explicit intent to use this specific skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

MCP server references in the skill manifest without version pinning are a rug-pull risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The instruction to treat any leftover words as an open brief and to 'do not drop words' makes the trigger scope and parsing behavior intentionally permissive. In an auto-routing environment, this increases the chance that unrelated conversational text is interpreted as a valid invocation payload, leading the skill to act on ambiguous requests and potentially generate or modify artifacts in contexts where the user did not clearly authorize this mode.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file explicitly instructs the agent to write output to a specific workspace path or modify an existing landing page in place, but it provides no guardrails such as confirmation prompts, backup requirements, or warnings about overwriting user content. In an agent context, this increases the risk of unintended file modification or destructive replacement of existing assets when the user may have expected a preview or non-destructive draft.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The router explicitly says the skill should 'pick the form from context' by default, which gives the agent broad discretion to select behaviors without a strong user-selected mode. In an agent setting, this can cause unintended file creation or modification paths to be triggered from weak signals, increasing the risk of surprising actions and overreach beyond the user's precise request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The 'Empty context' rule allows the skill to activate and generate a 'weenie' or 'first-run demo' even when there is no meaningful user signal. That makes unsolicited output or workspace changes possible from minimal or accidental invocation, which is risky for an autonomous coding assistant that may write artifacts into the workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation guidance says to load this form when the user mentions generic terms like document, docx, or md, or when the target file merely has a .docx/.md extension. Those triggers are broad and likely to match many ordinary requests, causing unintended skill activation and increasing the chance the agent rewrites or restructures content when the user did not explicitly ask for this behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation rule triggers whenever the user 'forces pdf' or when the target file is a PDF, which is broad enough to invoke this skill in many contexts beyond an explicit redesign request. Overly broad activation increases the chance the agent performs file parsing, package installation guidance, and PDF generation workflows on untrusted content unexpectedly, which can expand attack surface and cause unsafe or unintended tool use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly permits invocation as /reimagine-it simulation <any words the user typed>, which creates a very broad trigger surface and forwards arbitrary trailing text as an 'open brief' creative lens. In an agent/plugin context, this can cause over-activation, prompt confusion, or accidental execution on loosely matching user input, especially because unknown words are treated as meaningful modifiers rather than ignored.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction says to load the skill when 'the router picks a weenie,' but it does not define what inputs qualify or how this routing differs from nearby forms. That ambiguity can cause unintended invocation because the activation condition is not tied to specific phrases, constraints, or exclusion examples.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/research/web-craft-2025.md (reported line 56)May include surrounding context.

md

| `spellcheck="false"` `autocomplete="off"` where inappropriate | Stops browser suggesting nonsense for usernames, codes, etc. |
| `required` attribute where appropriate | Free HTML validation |
| Input prefix / suffix icons **absolutely positioned inside** the input | Not sitting next to it; the whole surface focuses |
| Toggles take effect immediately, no confirmation | Trust the user |
| Buttons disable **after** submit | No duplicate network requests |
| `user-select: none` inside interactive elements | Prevents accidental text selection on drag |
| Decorative elements (glows, gradients) `pointer-events: none` | They don't hijack clicks |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file instructs loading for several broad conditions, including generic page context such as an existing index.html, docs page, landing page, or dashboard. This can cause the skill to activate in situations the user did not explicitly request, increasing the chance that strong redesign directives are applied unexpectedly and that other safeguards or more appropriate skills are bypassed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.