Security audit

Miao Vision

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for local report and media artifact creation, but its export setup can load browser automation code from broad local locations during a nominal check, and some install paths are not fully pinned.

Install from a trusted, versioned bundle where possible, avoid the unpinned npx compatibility path unless you trust the source, and be careful running export setup inside an untrusted workspace because it may load local Playwright code. Approve CLI, Playwright, browser, and remote media setup only when you need those features, and do not upload sensitive raw data to optional media generation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (25)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.
md
After choosing the workflow, run `node scripts/check-miao-viz.mjs --print-path`.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
md
`node scripts/setup-export.mjs --host <host>` as a read-only check. In Pi use

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/article.md (reported line 78)May include surrounding context.
md
| Milestones | `timeline-path` | At least 3 milestones | | Shared-criteria comparison | `concept-contrast` | Include dimension keys beyond `label` and `text` | | Meaningful composition | `part-to-whole` | Values form a real whole | | Before/after state | `before-after` | Clear state boundary | | Four quadrants | `tradeoff-matrix` | Exactly 4 suitable items | | Ranking | `ranked-list-chart` | At least 3 ranked items | | Architecture or dependency flow | `system-diagram` | Explicit `nodes` and `edges` |

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill explicitly instructs the agent to execute local commands, inspect environment-dependent host/runtime details, and potentially install software, but it declares no explicit tool scope or permissions boundary. That mismatch can cause an agent runtime to grant broader capabilities than intended or make reviewers unable to verify whether command execution, environment inspection, and installation behaviors are properly constrained.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
md
- Use the resolved Miao Vision CLI for ordinary artifacts. Media workflows may use the checked ai-cli only after the user confirms charges and the exact prompt/reference upload scope. Installation requires separate approval. - Create only the requested artifact. Overwriting, deletion, publication, messaging, account changes, and repository operations need explicit authority. - Let the agent author specs; use the CLI for analysis, validation, and rendering. Do not edit generated HTML/PDF as source or call an LLM from the CLI.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The install instructions recommend npx skills add ... without pinning an exact package version or integrity, which means execution can depend on whatever package version is resolved at install time. That creates a supply-chain risk: a compromised upstream package, typosquat, or unexpected newer release could cause unreviewed code to run during installation in a local shell-capable environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The install command uses npx skills add ... without pinning an explicit version, so the fetched package or tool behavior can change over time and may introduce supply-chain risk. Because this is an installation instruction for a plugin/skill, users may execute it directly, making any compromise or unexpected upstream update impactful.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · install/pi.md (reported line 14)May include surrounding context.
md
scoped revision, or export a selected version. The package checks for the CLI version pinned by `cli-compatibility.json`. It does not download or upgrade the CLI without approval. The Review Viewer binds only to `127.0.0.1`; its URL is not a public sharing URL. ## Global CLI and exports

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Line L24 instructs the agent to append a Chinese-language string to the user's prompt in append_defaults mode. This forces a specific language/locale behavior without user opt-in or any stated justification, which matches the language-policy violation criteria.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/media-setup.md (reported line 13)May include surrounding context.
md
4. Ask them to restart or re-enter the Agent environment so it inherits the variable. 5. Verify with `node scripts/check-ai-media.mjs image` or `video`. Do not use a paid generation request as a configuration test. Never ask the user to paste the Key. Do not read, print, copy, persist, or pass its value in command arguments. Do not write it to the repository or a repository `.env`. Supplier-direct keys are not part of the supported first release. ## Price and Data Notice

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/outcome-brief.md (reported line 62)May include surrounding context.
md
| `nextAction` | Required behavior | |---|---| | `instantiate` | Instantiate the Spec without asking another question. | | `confirm` | Summarize the form, target, consequential assumptions, and safety warning; obtain confirmation before using `--confirm-plan`. | | `clarify` | Ask exactly `clarification.question`, using its options. Update the Draft Brief from the answer and rerun `artifact plan`; do not patch the Plan. | | `stop` | Explain the first selection reason and stop; do not guess another workflow. |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example confirmation text is hard-coded in Chinese, which can steer the agent to respond in Chinese even when the user did not request that language. In a multilingual skill, this can cause user confusion, consent friction, or miscommunication around privacy/safety confirmation prompts, especially if the user cannot fully understand the approval request.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to set locale only to en or zh-CN forces a narrow language/locale policy. Because the rule applies to all file types, this is a policy concern unless the skill explicitly offers a language choice or explains why the locale restriction is necessary.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/report.md (reported line 310)May include surrounding context.
md
listed reasons before sharing. `blocked` must not be delivered. Do not regenerate business meaning from `changes.json` when a period outcome brief exists. Generate one client report per update. Do not ask the user to choose a client, operator, or manager edition. Keep the readable body client-facing; evidence, methodology, data-quality details, anomalies, and review reasons belong in the collapsed diagnostics appendix. Only expose those details separately when the user requests diagnostics.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The runtime searches multiple broad locations, including the current workspace and host-specific directories, then treats any discovered Playwright package as trusted executable code. This creates a module-hijacking surface where a malicious or trojanized Playwright package in the workspace or host path could be loaded and executed when export features are used.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code dynamically resolves and loads Playwright from the filesystem and later uses its Chromium launcher, which means arbitrary JavaScript from the resolved package executes in-process. In a hostile workspace or host environment, an attacker who can place or replace that module can gain code execution through the skill's export path.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install/README.md (reported line 26)May include surrounding context.
md
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) VERSION=$(node -e 'process.stdout.write(require(process.argv[1]).recommendedCliVersion)' "$SCRIPT_DIR/../cli-compatibility.json") if ! npm install -g "@miao-vision/cli@$VERSION"; then echo 'Global npm installation failed. Check your npm prefix permissions or use a user-managed Node installation; no sudo was attempted.' >&2 exit 1 fi node "$SCRIPT_DIR/check-miao-viz.mjs" --require-recommended --print-path

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install/claude.md (reported line 25)May include surrounding context.
md
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) VERSION=$(node -e 'process.stdout.write(require(process.argv[1]).recommendedCliVersion)' "$SCRIPT_DIR/../cli-compatibility.json") if ! npm install -g "@miao-vision/cli@$VERSION"; then echo 'Global npm installation failed. Check your npm prefix permissions or use a user-managed Node installation; no sudo was attempted.' >&2 exit 1 fi node "$SCRIPT_DIR/check-miao-viz.mjs" --require-recommended --print-path

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install/codex.md (reported line 21)May include surrounding context.
md
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) VERSION=$(node -e 'process.stdout.write(require(process.argv[1]).recommendedCliVersion)' "$SCRIPT_DIR/../cli-compatibility.json") if ! npm install -g "@miao-vision/cli@$VERSION"; then echo 'Global npm installation failed. Check your npm prefix permissions or use a user-managed Node installation; no sudo was attempted.' >&2 exit 1 fi node "$SCRIPT_DIR/check-miao-viz.mjs" --require-recommended --print-path

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · install/openclaw.md (reported line 30)May include surrounding context.
md
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) VERSION=$(node -e 'process.stdout.write(require(process.argv[1]).recommendedCliVersion)' "$SCRIPT_DIR/../cli-compatibility.json") if ! npm install -g "@miao-vision/cli@$VERSION"; then echo 'Global npm installation failed. Check your npm prefix permissions or use a user-managed Node installation; no sudo was attempted.' >&2 exit 1 fi node "$SCRIPT_DIR/check-miao-viz.mjs" --require-recommended --print-path

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install-miao-viz.sh (reported line 6)May include surrounding context.
sh
SCRIPT_DIR=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd) VERSION=$(node -e 'process.stdout.write(require(process.argv[1]).recommendedCliVersion)' "$SCRIPT_DIR/../cli-compatibility.json") if ! npm install -g "@miao-vision/cli@$VERSION"; then echo 'Global npm installation failed. Check your npm prefix permissions or use a user-managed Node installation; no sudo was attempted.' >&2 exit 1 fi node "$SCRIPT_DIR/check-miao-viz.mjs" --require-recommended --print-path

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown includes substantial Chinese-language instructions in an otherwise English document, which can impose a locale or language expectation on users. The policy allows locale constraints only when clearly documented and justified, or when the user is given a choice; here the mixed-language behavior is not framed as an explicit opt-in choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The error guidance tells users to run '/miao-viewer setup', which conflicts with the manifested skill name and purpose centered on 'miao-vision'. This is not merely incomplete wording; it actively points to a different command surface, which can mislead users about which skill or component is actually responsible for the behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback guidance for missing Playwright again references '/miao-viewer setup' rather than a miao-vision command or clearly documented external dependency. Repeated contradictory messaging increases the mismatch between the documented skill intent and the operational instructions exposed by the code.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The launch error remediation text points users to '/miao-viewer setup', which contradicts the stated skill name and can cause confusion about which tool is meant to be invoked. Because it is repeated in operational error handling, this is an active documentation-to-code intent mismatch rather than a minor omission.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/ai-media-runtime.mjs:100

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/check-miao-viz.mjs:17

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup-export.mjs:12