Ae7
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
File exceeds the analyzable size limit; trailing content was not inspected
- Content
Security audit
拾光报：整期报纸制作
Security checks for vulnerabilities and agentic risk
Overview
The skill’s newspaper-making workflow and local file tools are proportionate, with routine dependency and photo-privacy considerations.
Use a separate environment with reviewed dependency versions. Confirm that your chosen image provider may receive any supplied photos, and remember that project archives preserve source images and prompts. Keep approval checkpoints unless you explicitly delegate them; imported approval records are not fresh permission. Dependency versions and live image-provider behavior were not verified in this static review.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write, network.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Project metadata asserts delegated user authority to bypass approval checkpoints.
Medium
- Category
- Prompt Injection
- Confidence
- 93% confidence
- Finding
The Chinese text claims the user has authorized the agent to act on their behalf at the plan, front-page, and completed-issue checkpoints, explicitly stating that no further confirmation is needed. Framing this as a limited fictional production test makes the permission escalation appear routine, but project-file content is not independent evidence of user authorization.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
text permit persons to whom the Software is furnished to do so. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
Pillow>=10 permits installations to resolve to different, unreviewed releases without an integrity-checked lockfile in the supplied source. This is a supply-chain hardening weakness rather than proof of compromise, but image processing is central to this skill and makes dependency integrity relevant.
- Content
text Pillow>=10 reportlab>=4
Unverifiable Dependency: Pillow has 211 known advisory(ies) (CVE-2026-112390 (Pillow: Infinite loop in MIC n_frames when the embedded TIFF); CVE-2026-96638 (Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / ab); CVE-2026-112391 (Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tr) +208 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
reportlab>=4 allows dependency resolution to change over time without reviewed version or hash constraints in this source. Because PDF export is an intended operation, an unexpected or compromised permitted release could affect the production environment, although no compromised release is demonstrated here.
- Content
text Pillow>=10 reportlab>=4
Unverifiable Dependency: reportlab has 8 known advisory(ies) (CVE-2023-33733 (Reportlab vulnerable to remote code execution); CVE-2020-28463 (Server-side Request Forgery (SSRF) via img tags in reportlab); CVE-2019-19450 (ReportLab vulnerable to remote code execution via paraparser) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
OSV returned advisories for this package, but its resolved version is unknown. A package-name lookup does not establish whether the installed release is affected by those advisories.
- Content