Storybook Generator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:32 AM UTC
• Version: 3.0.0

Overview

The skill's storybook-generation purpose is coherent, but it relies on mutable third-party installs and an unattended remote workflow install that users should review before use.

Before installing, confirm you trust AnyGen and are comfortable sending story prompts and related content to its service. Prefer a reviewed, pinned CLI/workflow version, avoid automatic `-y` installs where possible, and do not paste real API keys directly into command-line arguments.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party CLI Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10-14 **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml install: - id: node kind: node package: "@anygen/cli" bins: ["anygen"] ``` ### Technical Analysis The skill requires installation and execution of the third-party npm package `@anygen/cli`, but it does not pin an exact package version or provide an integrity hash. Consequently, the code installed at deployment time may differ from the code available when the skill was reviewed. npm packages may also execute lifecycle scripts during installation. If the upstream package, maintainer account, or package distribution channel is compromised, malicious code could execute with the privileges of the user or agent installing the skill. The repository contains no copy of the dependency implementation, lockfile, checksum, or other mechanism that would permit verification of the installed artifact. ### Attack Path 1. An attacker compromises the package, its maintainer account, or its distribution process. 2. A malicious version of `@anygen/cli` is published under the expected package name. 3. The skill installation process resolves the mutable package reference to the compromised release. 4. Package installation scripts or the resulting `anygen` executable run locally. 5. The malicious dependency accesses resources available to the invoking process, potentially including project files, authentication environment variables, and network services. ### Impact Assessment Successful exploitation could execute arbitrary code with the privileges of the agent or user performing the installation. Accessible resources may include files within the user's permission boundary, environment variables such as `ANYGEN_API_KEY`, and network credentials or services available in that execution environment. No evidence establishes that the current package is malicious; the issue is the abse ...[truncated 52 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `@anygen/cli` to an exact, reviewed version rather than using an unversioned package reference. - Record and verify the package integrity hash through a lockfile or equivalent trusted manifest. - Document the expected official package registry and source repository. - Review package contents and installation lifecycle scripts before deployment. - Disable npm lifecycle scripts where operationally feasible. - Run the CLI in a sandbox with only the filesystem, environment, and network access required for story generation. - Establish a controlled update process that requires review before changing the pinned version. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:41
• Finding: Unattended Retrieval and Installation of Mutable Remote Skill Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 41-46 **Vulnerability Type**: Dynamic remote payload retrieval and installation **Risk Level**: Medium ### Vulnerable Code ```markdown If the `anygen-workflow-generate` skill is not available, install it first: ```bash anygen skill install --platform <openclaw|claude-code> -y ``` ``` ### Technical Analysis The skill instructs the agent to install additional skill content through the external `anygen` CLI when `anygen-workflow-generate` is unavailable. The command does not identify an immutable version, checksum, or verifiable source for the content being retrieved. Therefore, the effective instructions or executable material can change after this project has been audited. The `-y` option indicates unattended confirmation, reducing the opportunity for the user to inspect or reject downloaded content. Because the retrieved workflow is outside the audited repository, its behavior and trustworthiness cannot be established from the available project files. ### Attack Path 1. The `anygen-workflow-generate` skill is absent from the environment. 2. Following `SKILL.md`, the agent invokes the installation command with automatic confirmation. 3. The external CLI contacts its configured service or repository and retrieves mutable skill content. 4. If the source, transport path, service account, or published artifact has been compromised, attacker-controlled instructions or code are installed. 5. The agent loads or follows the newly installed workflow, allowing the remote content to influence agent behavior or execute within the capabilities granted to that workflow. ### Impact Assessment The installed content could alter agent instructions or execute code with the capabilities available to the skill runtime. Potential scope includes access to files, environment variables, tools, and network services exposed to that runtime. The exact impact cannot be determined because the remote workflow is ...[truncated 182 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bundle the required workflow with the reviewed project whenever possible. - If remote installation is necessary, identify the exact workflow package and pin it to an immutable version or content digest. - Retrieve artifacts only from a documented, trusted HTTPS endpoint. - Verify a cryptographic checksum or signature before installation. - Remove `-y` and require explicit user approval after presenting the source, version, requested capabilities, and integrity information. - Review downloaded instructions and executable files before loading them into the agent. - Apply least-privilege sandboxing to remotely obtained workflows. - Fail safely if the expected version or integrity verification cannot be satisfied. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:27
• Finding: API Key May Be Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27-29 **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # Direct API key anygen auth login --api-key sk-xxx ``` ### Technical Analysis The documented authentication method encourages users to place an API key directly in a command-line argument. After replacing the placeholder with a real secret, the key may be exposed through shell history, terminal session logs, process-monitoring interfaces, audit systems, debugging output, or command-capture tooling. Command-line arguments are generally not an appropriate secret transport because they can be observable beyond the intended process. The project also documents an environment-variable method, but it does not warn users against the command-line form or explain safer secret-entry practices. ### Attack Path 1. A user replaces `sk-xxx` with a valid AnyGen API key. 2. The user executes the command in an interactive shell or automated environment. 3. The complete command is retained in shell history, captured in logs, or observed through process inspection while it is running. 4. Another local user, support operator, monitoring system, or attacker with access to those records obtains the key. 5. The exposed credential is reused to authenticate to AnyGen services. ### Impact Assessment An attacker who obtains the key may perform API operations authorized for that credential, consume account quotas, incur charges, or access account resources exposed through the associated API permissions. The precise scope depends on the privileges assigned to the key and the AnyGen service's authorization model. This finding does not establish that a real secret is hardcoded in the repository; the displayed value is only a placeholder. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the command-line API-key example or explicitly mark it as unsafe for real credentials. - Prefer interactive secret entry that disables terminal echo. - Support reading the key from standard input or a platform-managed secret store. - If an environment variable is used, inject it only for the required process and avoid saving it in shell initialization files, source code, or logs. - Redact credentials from diagnostic messages and audit output. - Advise users to rotate any key that may have been entered on a command line or retained in command history. - Apply narrowly scoped permissions, usage limits, and expiration policies to API keys where supported. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The activation description is overly broad and can cause the skill to trigger for a wide range of requests involving stories, guides, tutorials, or brand content, even when the user may not intend to send content to an external generation service. In this skill’s context, that increases the chance of unnecessary invocation of a server-side tool and accidental transmission of prompts or sensitive material to AnyGen.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that generation happens server-side at www.anygen.io, but it does not clearly warn users in the skill description or usage guidance that prompts, story text, images, and related content may be transmitted to a third-party external service. This can lead to privacy and data-handling risks, especially if users include confidential, proprietary, or personal information in story requests.

Static analysis

No suspicious patterns detected.