Security audit
Security checks for vulnerabilities and agentic risk
This is mostly a coherent picture-book generation skill, but it needs review because it repeatedly requires watermark and attribution-marker suppression while also automatically saving generated content locally.
Review before installing if you do not want image prompts that suppress watermark, signature, logo, branding, copyright, or URL markers. Use this only for original or authorized picture-book work, do not use it to remove attribution from existing images, and be aware that generated stories are saved under ./output/picture-books/.
This prompt block directly instructs suppression of watermarks, signatures, logos, branding, copyright symbols, and URLs. That is a classic attribution/provenance removal pattern and is not necessary for a children's educational book skill, making the capability materially more dangerous because it operationalizes misuse in ready-to-copy text.
The declared purpose describes a creative content-generation skill for bilingual children's picture books. The supplied code does not generate stories, prompts, images, styles, age-based content, or learning materials. Instead, it is a maintenance shell script whose sole function is to remove selected documentation files from the skill directory, optionally in dry-run mode. This is a materially different primary purpose and introduces undeclared file-system modification capability. The behavior is unrelated to the advertised picture-book generation functionality, so this is a clear mismatch.
The declared purpose focuses on generating children's bilingual picture books and related creative/educational content. The actual code does not generate stories, prompts, illustrations, styles, scenes, or learning materials. Instead, it performs repository/documentation maintenance by enumerating Markdown files, counting lines, summarizing directories, listing large files, and checking for Chinese/English guide pairs. This is a materially different primary purpose and introduces undeclared filesystem/document analysis capabilities unrelated to the described end-user picture-book generation function.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if signature not in prompt:
WARN → f"缺少签名特征: {signature}"
AUTO_ADD signature to prompt
return prompt
```
#### 2.5 Error Messages
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
if signature not in prompt: WARN → f"缺少签名特征: {signature}" AUTO_ADD signature to prompt return prompt
#### 2.5 Error Messages
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
\n - Outerwear (if any): [specific + color]\n Example: \"red windbreaker\
\ jacket\"\n\n5. ACCESSORIES (固定特征 - FIXED FEATURES)\n 配饰固定特征\n - Always\
\ visible: [items that appear in every page]\n Example: \"small blue backpack\
\ with teddy bear keychain\"\n - Sometimes visible: [items that may be held/set\
\ down]\n Example: \"water bottle in hand or in backpack side pocket\"\n\
\ - Signature items: [unique identifiers]\n Example: \"rainbow friendship\
\ bracelet on left wrist\"\n\n6. BODY TYPE (固定特征 - FIXED FEATURES)\n 体型固定特征\n\
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
\n - Outerwear (if any): [specific + color]\n Example: \"red windbreaker\
\ jacket\"\n\n5. ACCESSORIES (固定特征 - FIXED FEATURES)\n 配饰固定特征\n - Always\
\ visible: [items that appear in every page]\n Example: \"small blue backpack\
\ with teddy bear keychain\"\n - Sometimes visible: [items that may be held/set\
\ down]\n Example: \"water bottle in hand or in backpack side pocket\"\n\
\ - Signature items: [unique identifiers]\n Example: \"rainbow friendship\
\ bracelet on left wrist\"\n\n6. BODY TYPE (固定特征 - FIXED FEATURES)\n 体型固定特征\n\
The configuration contains explicit implementation guidance to update SKILL.md workflow and related files, which is effectively self-modification or instructions to alter the agent's own operational definition. In an agent setting, embedded self-edit directives are risky because they can cause uncontrolled capability changes, bypass review, or let content influence future system behavior beyond the current task.
2. Add CONSISTENCY ENFORCEMENT command templates
3. Update examples with compressed prompts'
'Phase 2: Update SKILL.md Workflow (Immediate)': '1. Replace old CCLP workflow with
4.0 enhanced version
2. Enforce prompt compression to 280-300 words max
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
**Example**:
- Adding a new emotion: Add entry to `story-soul.md`, system auto-integrates
- Adding a new style: Add entry to `styles.md`, update SKILL.md list
- Adding a new theme: Add to `story-soul.md` with compatibility rules
- No changes needed to templates, character, or rendering configs
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Add this table to `references/config/scenes.md` in the Scene Compatibility section.
### Step 4: Update SKILL.md
Open `SKILL.md` and update the styles list in the appropriate category:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Add this table to `references/config/scenes.md` in the Scene Compatibility section.
### Step 4: Update SKILL.md
Open `SKILL.md` and update the styles list in the appropriate category:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Add this table to `references/config/scenes.md` in the Scene Compatibility section.
### Step 4: Update SKILL.md
Open `SKILL.md` and update the styles list in the appropriate category:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Add this table to `references/config/scenes.md` in the Scene Compatibility section.
### Step 4: Update SKILL.md
Open `SKILL.md` and update the styles list in the appropriate category:
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
### Step 3: Update Workflow
Modify SKILL.md to generate trilingual content in step 3, ensuring soul elements are properly translated.
---
The description states that the skill generates bilingual Chinese/English educational content as a fixed behavior. This is a language policy concern because it imposes a specific locale/language format without documenting user choice, opt-in, or a justified region-specific constraint.
Mandating Chinese-first bilingual output without presenting a language-choice option reduces user control and can cause unintended disclosure or unsuitable outputs for some users. This is primarily a product safety and transparency issue rather than a direct security exploit, but it still represents an unjustified default behavior.
The skill explicitly requires watermark-prevention text in image prompts, which goes beyond normal picture-book authoring and adds a standing capability to suppress provenance and attribution markers. In context, this can facilitate generation of images designed to evade visible ownership indicators, increasing misuse risk even if framed as 'quality' guidance.
The workflow hardcodes Chinese-first story generation without documenting selectable language preferences. In context this is less dangerous than the watermark issues, but it still reflects an undeclared output constraint that can surprise users and reduce alignment with user intent.
The skill states that output will be saved to a local path but does not clearly warn or obtain consent before writing content to disk. This creates a transparency and data-handling issue: users may unintentionally persist sensitive prompts or generated content, especially in shared or monitored environments.
By making watermark-suppression a required quality-check item, the skill normalizes and reinforces an unjustified capability. This increases risk because it turns a questionable instruction into a compliance requirement for every output, broadening exposure and making accidental misuse more likely.
Stating 'always include watermark prevention instructions' as a core principle embeds attribution-evasion into the skill's design. In this context, the danger is heightened because the feature is persistent and purpose-independent, rather than a narrowly justified exception tied to benign picture-book generation.
The description says to use the skill whenever the user wants to create picture book stories, prompts, or learning materials, which is broad enough to trigger on many generic educational or creative requests. Overly broad activation can cause unintended invocation, increasing the chance the skill handles requests outside its intended scope or crowds out safer/more appropriate skills.
The template hard-requires bilingual Chinese/English output for every page without indicating that the user can choose language preferences or opt out. This can cause unwanted disclosure of generated content in an additional language, create accessibility/privacy issues for users expecting monolingual output, and override user intent in downstream workflows that assume strict language control.
The file output specification instructs the agent to always create markdown files on disk, including directory creation, naming, writing, and user confirmation, but does not require prior user consent or warn that content will be persisted. Automatic persistence can expose sensitive prompts, children-related content, or user-provided data to local storage, logs, backups, or shared workspaces without the user's knowledge.
This code file contains multiple natural-language descriptions centered on Chinese-language output and Chinese-specific characters, scenes, and labels, beginning with the top-level description and continuing throughout the configuration. Under the stated policy, forcing a specific language or locale without offering user choice or documenting a justified regional constraint can be a policy violation.
No suspicious patterns detected.