Security audit

Meitu Carousel

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate image/design assistant, but it needs review because it can send user content to Meitu and persist cross-project style preferences without clear enough user consent or controls.

Install only if you are comfortable with prompts, draft copy, and reference images being processed by Meitu, and with the skill keeping style preferences for reuse across projects. Avoid using confidential images or proprietary campaign text unless you have approval, and check whether the memory files can be inspected and deleted before relying on the memory feature.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill sends user prompts, generated copy, and potentially reference images to a third-party API via meitu-cli, but the description does not clearly warn users that their content leaves the local environment. This can cause unintended disclosure of sensitive business, personal, or proprietary visual/text content.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The protocol instructs the agent to create directories/files and write user-derived observations automatically when the user gives style approval, but it does not require a contemporaneous user-facing disclosure or consent at the time of collection. Silent persistence of preference data is risky because users may reasonably believe they are only giving feedback for the current task, not authorizing cross-project storage.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The promotion flow persists distilled preferences into long-lived memory files and deletes the original observation entry, but the description only adds a confirmation for promotion, not an explicit warning covering the full data-modification lifecycle. This can mislead users about both retention and deletion semantics, especially because the original data is transformed and moved rather than simply discarded.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill explicitly constrains output to Chinese only, which can override or conflict with a user's preferred language and reduce user control over the agent's behavior. While not a classic code-execution issue, it is a prompt-safety and policy-compliance problem because hardcoded language restrictions can cause the agent to ignore user intent or higher-level orchestration requirements.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The skill directs the agent to persist style-preference feedback across projects in observations.yaml, creating a behavioral profile over time. Even though the content is framed as design preference, cross-project aggregation increases privacy risk and can expose user habits or project associations if accessed by unauthorized parties or reused beyond the original context.

Ssd 3

Medium

Confidence: 91% confidence
Finding: This flow summarizes repeated behavior across multiple projects and stores it in longer-lived scene/global memory after a confirmation prompt, which is a real privacy-sensitive persistence mechanism. The confirmation reduces risk, but the context still makes it dangerous because it converts repeated interactions into durable profile data that may outlast user expectations and broaden reuse scope.

Static analysis

No suspicious patterns detected.