Kart Io Picture Book Wizard

• Outcome: Review
• Latest audit: Jul 8, 2026 · 10:06 AM UTC
• Version: 1.0.0

Overview

The skill mostly matches a bilingual picture-book generator, but it needs review because it automatically saves outputs and includes guidance to suppress or remove watermark/provenance marks.

Install only if you are comfortable with generated stories and prompts being saved locally under ./output/picture-books. Avoid using the watermark-removal or provenance-suppression guidance unless you have clear rights to the images and provider terms allow it, and do not run the cleanup script unless you intend to delete the listed documentation files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The template instructs the agent to always create markdown files, create directories, and write outputs to a persistent path on the local filesystem. In an agent skill whose primary role is content generation, this expands behavior into side-effecting file operations that may occur without explicit per-request user consent, increasing the risk of unintended data persistence, overwrites, path misuse, or abuse in environments where filesystem access is sensitive.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The reference explicitly states that all generated content is automatically saved to disk under a predictable path, which expands the skill from content generation into persistent side-effect behavior. Undisclosed file writes can create privacy, data retention, and workspace integrity risks, especially if users do not expect prompts or generated stories to be stored automatically.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script performs destructive repository changes by deleting multiple documentation files, including files outside the core runtime behavior of the picture-book skill. Because the deletions are hard-coded and only guarded by an optional dry-run flag, a user running the script can unintentionally lose documentation content, which is risky in a skill whose stated purpose is content generation rather than repository maintenance.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The comments state that the script removes Chinese duplicate documents, but the actual deletion list also includes the English usage guide. This mismatch can mislead maintainers into executing a script they believe has a narrower scope, increasing the chance of accidental deletion of non-duplicate or primary documentation.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill hard-codes bilingual Chinese/English output as the default behavior without indicating user choice, opt-in, or fallback to the user's preferred language. This can cause unintended disclosure, usability, or policy-compliance issues in contexts where only one language is appropriate, though the security impact is limited in this children's picture-book context.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The skill instructs saving generated content to a local output path without warning the user or requiring consent. Silent persistence can expose sensitive prompts or generated content to other local users, logs, backups, or later processing, especially if users assume the interaction is ephemeral.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill specifies that generated content will be written to a local output path, but it does not tell the user that their prompts and generated story content may be persisted. This creates a transparency and privacy issue because users may unknowingly cause storage of potentially sensitive inputs, especially if character names, learning details, or custom story content contain personal data.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The skill description is very broad, covering story creation, prompts, and learning materials across many domains, without defining clear activation boundaries. This can cause the agent to invoke the skill in loosely related contexts, increasing the chance of over-broad prompt injection exposure or inappropriate use, even though the file itself does not contain directly malicious instructions.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The configuration and file header indicate the skill is designed around a Chinese-language and Chinese-cultural default, and the rest of the file hardcodes Chinese names, cultural scenes, and bilingual assumptions without any visible user-consent or locale-selection mechanism. This can cause the agent to override user intent, produce culturally narrow outputs, or mishandle requests for other languages/cultures, which is a policy and product-safety issue even though it is not a code-execution risk.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The document describes automatic file creation without any warning, consent flow, or notice that generated content will be persisted. Even if the write location is fixed, silent persistence can expose sensitive user content, surprise users, and leave residual data in shared or synced environments.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: This section hard-codes a Chinese cultural context for kitchens, temples, and markets as normative guidance without clear user opt-in, locale scoping, or a statement that these rules apply only when the user explicitly requests Chinese cultural settings. In a content-generation skill, this can cause culturally misaligned outputs, stereotype reinforcement, and unintended disclosure or inference of user cultural preferences when the broader skill description suggests bilingual/global use.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The configuration repeatedly centers Chinese-specific defaults and examples, such as Chinese character labels, Chinese family roles, Chinese names, Tang suit, and traditional Chinese kitchen scenes, without indicating that these are optional or require user opt-in. In a general-purpose picture-book generation skill, this can cause unintended cultural steering, reduce user autonomy, and produce outputs misaligned with the user's language or cultural context.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The examples hard-code Chinese ethnicity, names, and culturally specific family descriptors as the default for child and family characters throughout the file. In a general-purpose picture-book generation skill, this can systematically bias outputs, reduce user agency, and lead to exclusionary or stereotyped content when users do not explicitly request that cultural framing.

Self-Modification

High

• Category: Rogue Agent

Content

2. Add CONSISTENCY ENFORCEMENT command templates

    3. Update examples with compressed prompts'
  'Phase 2: Update SKILL.md Workflow (Immediate)': '1. Replace old CCLP workflow with
    4.0 enhanced version

    2. Enforce prompt compression to 280-300 words max

• Confidence: 95% confidence
• Finding: The file contains self-modification guidance instructing updates to SKILL.md and related workflow components. In an agentic environment, instructions that direct modification of system or skill files can be repurposed into prompt-driven repository tampering or unauthorized configuration changes, especially if downstream tooling treats reference content as actionable rather than inert documentation.

Static analysis

No suspicious patterns detected.