Security audit

draw-skills

Security checks for vulnerabilities and agentic risk

Overview

This markdown-only skill is a coherent academic figure-prompt helper and does not request code execution, credentials, persistence, or hidden data access.

Before installing, know that the skill may include specific details from your paper in generated figure prompts and captions; avoid pasting confidential drafts into external drawing tools unless that is acceptable for your work. You may also want to override the default bilingual caption behavior if your manuscript requires one language only.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.
md
- Works alongside **academic-paper** skill: after writing a paper, use draw-skills to fill in figures - Works alongside **anthropic-skills:pdf**: PDF reading is handled natively; draw-skills interprets the content - Output prompts can also be used with Gemini, DALL-E, or Stable Diffusion with minor adjustments ---

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requires every figure block to include both English and Chinese captions without checking user preference or locale need. This is not a classic code-execution issue, but it can cause unintended disclosure, policy noncompliance, or workflow errors in settings where output language must be controlled, especially for confidential or publication-draft content.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger keyword list is broad and includes generic terms like 'draw figure', 'generate figure', and multilingual variants that can match ordinary conversation, causing the skill to activate outside its intended scope. Over-broad activation increases the chance of context hijacking, unintended interception of unrelated user requests, and incorrect routing to a tool-oriented workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill defines triggering primarily through keyword presence without robust scope constraints or disambiguation logic, so ambiguous requests may invoke the skill even when the user did not intend academic figure generation. In agent systems, this can lead to prompt-routing mistakes, unexpected behavior, and accidental exposure of user content to an unnecessary analysis pipeline.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The workflow states "Language: English" for prompt generation as a fixed requirement, which imposes a language choice on users. Although the file explains that nanobanana is optimized for English, it does not present this as a user-selectable option or opt-in behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction "Always write prompts in English" is a clear language-policy constraint applied universally to users. While a justification is provided, the skill does not offer an opt-in choice or alternative workflow for users who prefer another language.
Content: No source excerpt is available for this finding.