Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent local cover-image generator, with disclosed local file creation and preference storage that fit its purpose.
Before installing, be aware that the skill may save article drafts, prompt files, copied reference images, derived reference descriptions, and generated covers in local output folders. Prefer project-level preferences unless you want settings reused across projects, and avoid quick mode when you want to review style choices before generation.
The trigger phrase "make cover" is overly generic and can match ordinary user requests that are not specifically about article cover-image generation. This can cause unintended skill activation and lead the agent to perform file writes, content analysis, and image-generation steps in contexts the user did not clearly intend.
The documented quick mode allows the skill to skip confirmation and auto-select dimensions based on content, increasing autonomous behavior. In this skill's context, that can cause unintended content processing, prompt creation, and file output without a human review checkpoint, especially when combined with broad invocation phrases.
# Auto-select dimensions based on content
/tuzi-cover-image path/to/article.md
# Quick mode: skip confirmation
/tuzi-cover-image article.md --quick
# Specify dimensions
Advertising --quick as "Skip confirmation, use auto-selection" reinforces a workflow where the skill may proceed without validating user intent or persistence side effects. While not code execution, it still increases the chance of unauthorized or unexpected processing of user content and creation of files on disk.
| `--aspect <ratio>` | 16:9 (default), 2.35:1, 4:3, 3:2, 1:1, 3:4 |
| `--lang <code>` | Title language (en, zh, ja, etc.) |
| `--no-title` | Alias for `--text none` |
| `--quick` | Skip confirmation, use auto-selection |
| `--ref <files...>` | Reference images for style/composition guidance |
## Five Dimensions
The skill documents that it saves source content and reference images to disk, but it does not clearly warn users up front before activation or data handling occurs. This creates a privacy and data-governance risk because users may provide sensitive drafts or proprietary images without realizing they will be persisted locally.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
│
▼
┌─────────────────────┐
│ Create EXTEND.md │
└─────────────────────┘
│
▼
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
default_aspect: "2.35:1" # 2.35:1|16:9|1:1
quick_mode: false # Skip confirmation when true
language: null # zh|en|ja|ko|auto (null = auto-detect)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
default_aspect: "2.35:1" # 2.35:1|16:9|1:1
quick_mode: false # Skip confirmation when true
language: null # zh|en|ja|ko|auto (null = auto-detect)
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
default_aspect: "2.35:1" # 2.35:1|16:9|1:1
quick_mode: false # Skip confirmation when true
language: null # zh|en|ja|ko|auto (null = auto-detect)
The instruction says language is 'Auto-determined' and explicitly states there is 'No need to ask.' This imposes a language/locale decision on the user without an opt-in or explicit choice, which matches the policy-violation category for language or locale constraints.
The workflow instructs the agent to copy user-provided files into a local refs/ directory and create accompanying metadata files, but it does not require notifying the user or obtaining consent before writing to disk. In an agent setting, silent file creation can violate user expectations, create privacy issues, and expand the attack surface if untrusted paths or sensitive files are handled implicitly.
The instructions direct the agent to create refs/extracted-style.md from visual analysis when no file path is available, again without telling the user that derived content will be stored. Saving inferred or transformed data from user-provided imagery without disclosure can expose private information, persist sensitive derived data, and surprise users who did not authorize file writes.
The manifest says the skill supports cinematic (2.35:1), widescreen (16:9), and square (1:1) aspects, but this setup file offers 3:4 as a default option and states that 4:3 and 3:2 are also available during generation. That is a semantic mismatch between the declared capability set and the documented behavior of the skill.
This markdown file documents a preference that skips confirmation when enabled, which can affect user control over subsequent actions. The description states the behavior but does not provide a caution about the safety implications of bypassing confirmation.
The template requires Language: [confirmed language], and later instructs to 'Match confirmed language' without offering a user-selectable language option in this file. This can conflict with a language/locale policy if the skill enforces a specific language by default rather than making it user-directed.