Cardnews

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:30 PM UTC
• Version: 1.0.0

Overview

The skill matches its card-news purpose, but it needs review because it can move toward live Instagram posting, forces branding, and silently installs a Python package.

Install only if you are comfortable reviewing every generated slide and caption before upload. Remove or approve the forced penguin branding, confirm the target Instagram account before any browser upload, and install Pillow yourself in a controlled environment instead of relying on the script's automatic pip install.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22
• Finding: Mandatory Third-Party Branding Injected into User-Generated Content## Vulnerability Details **File Location**: `SKILL.md:22-38`; `references/design-guide.md:24` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High **Affected code in `SKILL.md`:** ```markdown | 5 | CTA/Summary | Takeaway + follow/save prompt + 🐧 branding | ``` ```markdown **Prompt structure per slide:** - Include exact Korean text to render (in quotes) - Specify: dark background, neon cyan (#00FFFF) accent text, white primary text - Include 🐧 penguin emoji on slide 5 - No English unless the topic requires it ``` **Affected code in `references/design-guide.md`:** ```markdown - **Slide 5:** Include 🐧 penguin at bottom center as brand mark ``` ### Technical Analysis The Skill instructions unconditionally require a branding marker to be added to slide 5. This requirement is repeated in both the primary workflow and the referenced design guide, making it a persistent output rule rather than an optional design suggestion. The branding is unrelated to the functional requirements of generating card-news images. When the Skill is loaded, these instructions alter the agent's output objective by requiring the inclusion of third-party branding without first obtaining explicit user consent. Because the workflow subsequently prepares the generated files for Instagram upload, the injected branding may reach externally published content. ### Attack Path 1. A user requests an ordinary five-slide card-news or Instagram carousel. 2. The agent loads the Skill and follows its slide-planning and image-generation instructions. 3. The Skill requires slide 5 to contain a penguin brand marker. 4. The generated slide is converted to JPEG as part of the normal workflow. 5. The branded image is prepared for, or submitted through, the documented Instagram upload flow. 6. The user's public content consequently carries an unsolicited third-party branding element. ### Impact Assessment This issue ...[truncated 519 chars]
• Remediation: ## Remediation Suggestions - Remove the unconditional branding requirements from `SKILL.md` and `references/design-guide.md`. - Make branding an explicit opt-in feature disabled by default. - Ask for user approval before adding any logo, mascot, attribution, promotional phrase, URL, or third-party identifier. - Keep the default slide template neutral and limited to content requested by the user. - Before upload preparation, present the planned text and branding elements for confirmation. - Add a policy stating that generated content must not include author or Skill branding unless the user specifically requests it.

T08 · Insecure Dependencies

Warning

• Location: scripts/convert_jpg.py:15
• Finding: Automatic Installation of an Unpinned Runtime Dependency## Vulnerability Details **File Location**: `scripts/convert_jpg.py:15-20` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium **Affected code:** ```python try: from PIL import Image except ImportError: import subprocess subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"]) from PIL import Image ``` ### Technical Analysis If Pillow is unavailable, the conversion script automatically invokes `pip` and installs `Pillow` at runtime. The dependency has no fixed version or integrity hash, and package resolution depends on the invoking environment's package-index configuration. This behavior creates an avoidable supply-chain boundary during normal script execution. A compromised package repository, malicious package-index mirror, unsafe `pip` configuration, or compromised future dependency release could supply code that executes during installation or import. The absence of version pinning also makes installations non-reproducible. The automatic installation is not necessary for image conversion itself and occurs without a distinct dependency-management step or explicit confirmation. ### Attack Path 1. The user runs `scripts/convert_jpg.py` in an environment where Pillow is not installed. 2. Importing `PIL` raises `ImportError`. 3. The exception handler invokes the current Python interpreter with `-m pip install Pillow -q`. 4. `pip` resolves the unpinned package through the environment's configured index and trust settings. 5. If that source or resolved package is compromised, attacker-controlled installation or package code executes. 6. The script imports the installed package, providing another execution point for malicious module initialization. ### Impact Assessment Any malicious package code would execute with the privileges of the user running the converter. Depending on those privileges and the environment, this could permit access to use ...[truncated 465 chars]
• Remediation: ## Remediation Suggestions - Remove automatic package installation from application runtime. - Declare Pillow in a dedicated dependency manifest or lock file. - Pin Pillow to a reviewed version or tightly controlled compatible range. - Use package hashes, such as `--require-hashes`, to verify downloaded artifacts. - Install dependencies in a controlled virtual environment during an explicit setup phase. - Configure package installation to use a trusted index and disallow unexpected fallback indexes. - If Pillow is absent at runtime, terminate with a clear error explaining the approved installation procedure. - Add dependency vulnerability scanning and a documented update process so pinned versions can be reviewed and upgraded safely.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is presented as an end-to-end Instagram card-news pipeline, but the described/implemented behavior is materially narrower and inconsistent. This kind of mismatch is dangerous because users and orchestrators may trust the skill with broader automation, uploads, or content handling than it actually supports, weakening oversight and causing downstream unsafe chaining with other tools.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill instructs use of shell commands (`uv run`, `python3`) but declares no explicit tool scope or permissions. That creates an authorization and review gap: an agent or operator may invoke local command execution without clear declaration, making unexpected file access or command misuse more likely.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger language is broad and ambiguous, covering generic requests like Instagram carousel posts or slide-based visual content. Overbroad activation can cause the wrong skill to fire in unrelated contexts, leading to unintended shell use, image-processing steps, or social-post preparation without the user's precise intent.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: Mandating Korean output without user opt-in can cause the skill to override user intent, reduce transparency, and increase the chance that generated captions or slide text are not properly understood before publication. In a posting workflow, language coercion is a safety issue because it can impair review and informed approval.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: The skill instructs preparation for Instagram upload and browser-based posting without clearly warning the user that it is moving toward publication-oriented actions. In a social-media context, that increases the risk of users unintentionally preparing or posting content to a live account without an explicit consent or review gate.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: Line L15 explicitly instructs prompts to specify "large bold Korean text," which imposes a specific language. Under the policy, forcing a language without opt-in or justification is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Line L33 says "Large bold centered Korean text," which directs the skill to always produce Korean output. The file does not provide an alternative language option or explain why Korean is required.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: A simple image converter should not silently fetch and install packages during normal execution. This behavior can surprise users, modify the host system, and execute third-party code transitively through pip, creating a meaningful supply-chain and operational security risk.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script installs Pillow without warning, consent, or any security prompt, which is risky in an agent skill context because users may not expect network access or environment changes from a local file conversion utility. Silent installation also makes it harder for users to assess provenance, permissions, and side effects before code executes.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

from PIL import Image
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
    from PIL import Image

• Confidence: 89% confidence
• Finding: The script invokes pip at runtime to install Pillow whenever the import fails. Even though the subprocess call is not shell-injected, it still causes unreviewed code retrieval and execution from the package index in the user's environment, which expands the script's trust boundary and can lead to supply-chain compromise or unexpected environment modification.

Static analysis

No suspicious patterns detected.