Security audit

ai-wallpaper-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but its API-token handling and configurable endpoint create a real credential-leak risk users should review before installing.

Install only if you are comfortable with a skill that changes your desktop wallpaper automatically and stores the generated image locally. Prefer using BAIDU_API_KEY from a protected environment rather than passing the token on the command line, do not use untrusted --base_url values, and consider pinning dependencies before use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/wallpaper_skill.py:75
Finding: API Credential Exposure Through Command-Line Arguments and Arbitrary API Endpoint Redirection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unbounded and Unverified Third-Party Dependency
Content: View full analysis
=1.0.0 ``` The README instructs users to install this dependency directly: ```bash pip install -r requirements.txt ``` ### Technical Analysis The version constraint permits every `openai` package release from version `1.0.0` onward, including future major versions that were not reviewed with this project. The dependency file also contains no package hashes or lock-file integrity data. As a result, two installations performed at different times can retrieve materially different code. A future compromised, malicious, or incompatible package release satisfying `>=1.0.0` could be installed automatically. Because the package is imported and used with an API credential, a compromised dependency would execute in the local Python process and could access the script's arguments, environment variables, files available to the user, and network connection. This finding does not establish that the current `openai` package is malicious. The vulnerability is the project's failure to constrain and verify the dependency artifact that will execute. ### Attack Path 1. A future package version satisfying `openai>=1.0.0` is published and is compromised, malicious, or incompatible. 2. A user follows the documented installation command: ```bash pip install -r requirements.txt ``` 3. Package resolution selects the new, unreviewed release. 4. The package is installed without validation against a project-maintained cryptographic hash. 5. When `wallpaper_skill.py` executes `from openai import OpenAI`, code from the installed package runs in the user's Python process. 6. A compromised package could read `BAIDU_API_KEY`, inspect prompts, access user-readable files, make arbitrary network requests, or perform other actions available to the current ope ...[truncated 617 chars]
Remediation: View remediation
``` 2. Generate a reproducible lock file containing hashes for all direct and transitive dependencies. 3. Install with hash verification, such as: ```bash pip install --require-hashes -r requirements.lock ``` 4. Review dependency upgrades before changing the pinned version, especially major-version updates. 5. Use automated vulnerability and supply-chain scanning in continuous integration. 6. Install dependencies inside an isolated virtual environment under a non-administrative account. 7. Configure package installation to use only approved package indexes and trusted TLS-protected sources. 8. Maintain a documented dependency-update process that verifies package provenance, release notes, compatibility, and integrity before deployment. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp1

High

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill executes an external program (osascript), which is a shell/process-execution capability not reflected in the declared permissions. Even though the current call is constrained, undeclared process-launch capability materially increases risk because it can be repurposed for broader local actions and should be surfaced to users and policy controls.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill executes an external program (osascript), which is a shell/process-execution capability not reflected in the declared permissions. Even though the current call is constrained, undeclared process-launch capability materially increases risk because it can be repurposed for broader local actions and should be surfaced to users and policy controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is designed to trigger on broad, everyday phrases like '换壁纸', '生成桌面', and '设置背景', which can plausibly appear in normal conversation without the user intending to authorize filesystem writes and system wallpaper changes. In this context, overbroad triggering is dangerous because the skill performs side effects on the local machine, including persistent file creation and modification of desktop settings.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly performs persistent writes to assets/wallpaper.png and changes the system wallpaper on Windows and macOS, but it does not require an explicit warning or confirmation immediately before those actions. This creates a real risk of surprising or unauthorized local side effects, particularly if the skill is mis-triggered or invoked from ambiguous user language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script presents user-facing status and error text in Chinese, such as the unsupported-platform message, and this pattern continues throughout the file. Because the skill does not offer language selection or justify a Chinese-only locale requirement, it violates the language/locale policy criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/wallpaper_skill.py (reported line 38)May include surrounding context.
python
end run """ try: subprocess.run( ["osascript", "-e", script, abs_path], check=True, capture_output=True,

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The argparse description says the skill uses '百度文心 API', and the API key help text specifically instructs use of 'BAIDU_API_KEY'. However, the implementation imports OpenAI and calls client.images.generate(...) against a generic OpenAI-compatible API base URL. This is an active documentation-to-code contradiction about what backend/service the skill is actually using.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: Natural-language content in the skill documentation appears to force a specific language for users reading or operating the skill, with no opt-in or alternative language guidance. Under the stated policy, a language constraint should either offer user choice or be clearly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README explicitly describes functionality that generates a file and changes the system wallpaper, but it does not warn users that running the skill will modify local filesystem contents and desktop settings. In an agent-skill context, undeclared side effects are security-relevant because users or hosting agents may invoke the skill expecting content generation only, while it also performs persistent local changes.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The dependency is specified with only a lower bound (openai>=1.0.0), which allows installation of any newer major or minor release. This creates supply-chain and stability risk because future upstream changes or a compromised release could be pulled in automatically, leading to unexpected behavior or exposure in a skill that generates content and modifies the user's desktop environment.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
openai>=1.0.0