Security audit

Storybook Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill's storybook-generation purpose is coherent, but it relies on mutable third-party installs and an unattended remote workflow install that users should review before use.

Before installing, confirm you trust AnyGen and are comfortable sending story prompts and related content to its service. Prefer a reviewed, pinned CLI/workflow version, avoid automatic `-y` installs where possible, and do not paste real API keys directly into command-line arguments.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:10
Finding: Unpinned Third-Party CLI Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:41
Finding: Unattended Retrieval and Installation of Mutable Remote Skill Content
Content: View full analysis
-y ``` ``` ### Technical Analysis The skill instructs the agent to install additional skill content through the external `anygen` CLI when `anygen-workflow-generate` is unavailable. The command does not identify an immutable version, checksum, or verifiable source for the content being retrieved. Therefore, the effective instructions or executable material can change after this project has been audited. The `-y` option indicates unattended confirmation, reducing the opportunity for the user to inspect or reject downloaded content. Because the retrieved workflow is outside the audited repository, its behavior and trustworthiness cannot be established from the available project files. ### Attack Path 1. The `anygen-workflow-generate` skill is absent from the environment. 2. Following `SKILL.md`, the agent invokes the installation command with automatic confirmation. 3. The external CLI contacts its configured service or repository and retrieves mutable skill content. 4. If the source, transport path, service account, or published artifact has been compromised, attacker-controlled instructions or code are installed. 5. The agent loads or follows the newly installed workflow, allowing the remote content to influence agent behavior or execute within the capabilities granted to that workflow. ### Impact Assessment The installed content could alter agent instructions or execute code with the capabilities available to the skill runtime. Potential scope includes access to files, environment variables, tools, and network services exposed to that runtime. The exact impact cannot be determined because the remote workflow is ...[truncated 182 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: API Key May Be Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation description is overly broad and can cause the skill to trigger for a wide range of requests involving stories, guides, tutorials, or brand content, even when the user may not intend to send content to an external generation service. In this skill’s context, that increases the chance of unnecessary invocation of a server-side tool and accidental transmission of prompts or sensitive material to AnyGen.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill states that generation happens server-side at www.anygen.io, but it does not clearly warn users in the skill description or usage guidance that prompts, story text, images, and related content may be transmitted to a third-party external service. This can lead to privacy and data-handling risks, especially if users include confidential, proprietary, or personal information in story requests.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.