Security audit

Dressup Playable Maker

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches a playable-ad generator, but it has under-disclosed ad redirection and unsafe HTML generation risks that users should review before installing.

Review and edit generated ads before publishing. Do not run the generator on untrusted asset folders or copied command lines, and verify that the CTA URL matches your own campaign because the current template defaults to a specific app store destination.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.py:47
Finding: Arbitrary JavaScript Injection Through Crafted Asset Filenames
Content: View full analysis
{ const btn = document.createElement("button"); btn.className = "item-btn " + category; btn.setAttribute("data-index", index); btn.innerHTML = ""; btn.onclick = () => selectItem(category, src, index); }); ``` ```javascript // assets/template/index.html:176-178 if (category === "hair") document.getElementById("layer-front-hair").innerHTML = ""; else if (category === "dress") document.getElementById("layer-dress").innerHTML = ""; else if (category === "shoes") document.getElementById("layer-shoes").innerHTML = ""; ``` ### Technical Analysis The generator treats filenames from the caller-controlled input directory as trusted JavaScript source text. It checks only whether each filename ends in `.png`, `.jpg`, or `.jpeg`. It does not restrict metacharacters or escape the filename before placing it inside a single-quoted JavaScript stri ...[truncated 2031 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate.py:78
Finding: Arbitrary HTML and JavaScript Injection Through the Primary Color Argument
Content: View full analysis
{custom_css}" html = html.replace('', f'{css_block}') ``` ```python # scripts/generate.py:91-92 parser.add_argument('--scale', type=float, default=1.1, help='Character scale factor') parser.add_argument('--primary-color', default='#ff69b4', help='Primary theme color') ``` ```python # scripts/generate.py:110-115 # Generate custom CSS custom_css = f""" :root {{ --character-scale: {args.scale}; --primary-color: {args.primary_color}; }} """ ``` ### Technical Analysis The `--primary-color` command-line value is unrestricted text. It is interpolated into a CSS block, after which the complete block is concatenated directly into the HTML document. HTML parsing rules, rather than CSS parsing rules, determine where a `` element ends. Consequently, a value containing a closing style tag can leave the CSS context and introduce arbitrary HTML, including a script element. For example, a value shaped like the following would cross the intended context boundary: ```text ``` The `--scale` argument is parsed as a Python float and therefore does not expose the same direct injection primitive. The vulnerable input is specifically `--primary-color`. ### Attack Path 1. An attacker controls or influences a build command, CI configuration, wrapper script, or copied generation instructions. 2. The attacker supplies a crafted `--primary-color` value containing a closing `style` tag and attacker-controlled HTML. 3. `main()` interpolates that value into `custom_css`. 4. `update_template()` wraps the text in another `<style>` element and ins ...[truncated 664 chars]
Remediation: View remediation
`, quotes, semicolons, CSS functions, comments, newlines, and malformed color values. 6. Treat generation arguments in CI and automation as untrusted configuration unless they come from a reviewed, access-controlled source. ]]>

other

Warning

Location: assets/template/index.html:16
Finding: Generated Advertisements Contain a Fixed External CTA Destination
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill claims to create dress-up playable ads, but the referenced output includes an MRAID runtime/API surface with functions for opening external URLs and exposing device/ad-container capabilities. That mismatch matters because it can conceal navigation, tracking, or privileged ad-environment interactions beyond simple asset templating, increasing the risk of misuse or reviewer confusion.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
Modify `steps` array in `index.html` to change clothing categories:

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
Modify `steps` array in `index.html` to change clothing categories:

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · assets/template/index.html (reported line 98)May include surrounding context.
html
QVd/TUvncxzBCcAA0iEnTZxSGF1Xykei4QeQ6ouIIXEwJSp5fimzTKJV2Dl42srVl2m/FEZugLawQqM4JouaxEKoRZNd2HM11FS5GKSFWaMtL0uzbCA6ARtMxtshJOiWEqKbjaI7CcQJXY9ue78TPPS9uXFBIzBrTkfhtLTyhHCNJ3CeC4jiyKLLfs6ggxDnlGfMXzMAkPUBD6uxfdCIjnjjjNFczBe4z6dO/ajk1L/5ex5+UXlOEqNw34quXHEPiVEoI1XXTF9ow1wbQsApDSFgyWHDosq2J3A9IfvAfvxdMZ8Ghc98SjNANOZXEBCdQR2OOHqCBFQYS0xMppaL2k+Cw+MzcP6+ejOYJtbhvSbLrqiSmO1oxiXN7ABrajMFFpaRQajiOwn1PL7fPSPyx8T9Zq5iaKxGi68TSzOLIzgQANLQZw4piyYz7sqbAfYfP969nio4FB/02N2QtlAghlsRpRmYocgOg4dWSI5RYcEjct9RyZkE9zZpB/LevHFLohgJhdDG0MuzeFwBoeCw5DC/QZNP4oTSarqsYkSx/Wx4VHEdUKSW6EqqpWejCAjQFVueQPE8zFev70ujERD3GZwghX/2WpCiGpMfb11e0LksAQHOYMTDD+Z6jSDr3FVpO1bfbYm2e13X9S/5YhihKnCVrQnEctm8ANI/CqIwVlWSDql+/cOSH1VeO6MzwqvSxI2upVJVERRENx9EHjZmRAIDmURiT0YOSqH61wtBppt51RbqoqzRODj2eS2G5YTq2WGyfibIoQHPpHD+I2r701dYtvZis9wVhFrUoJZT9xY1ZlhuaJhXZTBsANJmOWSkSRvqXHRiqVBxe99C+IOqUfEQNU7ZDNTMEu8wBmtCkmdmi4tLPjVRFTU2r+6fmf8kNopuhJi/PzsKuL4DmtGx0UXIsonKMIsfzbfUalSefGbZtrBixIAEATWpeumhpBrU4QdGs/F887AvylNTocq8nFAdimQLQxKYPy5BQoZw

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire guide is written in Chinese and does not indicate that other languages are supported or that Chinese is a required locale for a region-specific workflow. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.