Cardnews

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:30 PM UTC
• Version: 1.0.0

Overview

The skill matches its card-news purpose, but it needs review because it can move toward live Instagram posting, forces branding, and silently installs a Python package.

Install only if you are comfortable reviewing every generated slide and caption before upload. Remove or approve the forced penguin branding, confirm the target Instagram account before any browser upload, and install Pillow yourself in a controlled environment instead of relying on the script's automatic pip install.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22

Finding

Mandatory Third-Party Branding Injected into User-Generated Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:22-38; references/design-guide.md:24
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Affected code in SKILL.md:

markdown

| 5 | CTA/Summary | Takeaway + follow/save prompt + 🐧 branding |

markdown

**Prompt structure per slide:**
- Include exact Korean text to render (in quotes)
- Specify: dark background, neon cyan (#00FFFF) accent text, white primary text
- Include 🐧 penguin emoji on slide 5
- No English unless the topic requires it

Affected code in references/design-guide.md:

markdown

- **Slide 5:** Include 🐧 penguin at bottom center as brand mark

Technical Analysis

The Skill instructions unconditionally require a branding marker to be added to slide 5. This requirement is repeated in both the primary workflow and the referenced design guide, making it a persistent output rule rather than an optional design suggestion.

The branding is unrelated to the functional requirements of generating card-news images. When the Skill is loaded, these instructions alter the agent's output objective by requiring the inclusion of third-party branding without first obtaining explicit user consent. Because the workflow subsequently prepares the generated files for Instagram upload, the injected branding may reach externally published content.

Attack Path

1. A user requests an ordinary five-slide card-news or Instagram carousel.
2. The agent loads the Skill and follows its slide-planning and image-generation instructions.
3. The Skill requires slide 5 to contain a penguin brand marker.
4. The generated slide is converted to JPEG as part of the normal workflow.
5. The branded image is prepared for, or submitted through, the documented Instagram upload flow.
6. The user's public content consequently carries an unsolicited third-party branding element.

Impact Assessment

This issue ...[truncated 519 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional branding requirements from SKILL.md and references/design-guide.md.
• Make branding an explicit opt-in feature disabled by default.
• Ask for user approval before adding any logo, mascot, attribution, promotional phrase, URL, or third-party identifier.
• Keep the default slide template neutral and limited to content requested by the user.
• Before upload preparation, present the planned text and branding elements for confirmation.
• Add a policy stating that generated content must not include author or Skill branding unless the user specifically requests it.

T08 · Insecure Dependencies

Warning

• Location: scripts/convert_jpg.py:15

Finding

Automatic Installation of an Unpinned Runtime Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/convert_jpg.py:15-20
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Affected code:

python

try:
    from PIL import Image
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
    from PIL import Image

Technical Analysis

If Pillow is unavailable, the conversion script automatically invokes pip and installs Pillow at runtime. The dependency has no fixed version or integrity hash, and package resolution depends on the invoking environment's package-index configuration.

This behavior creates an avoidable supply-chain boundary during normal script execution. A compromised package repository, malicious package-index mirror, unsafe pip configuration, or compromised future dependency release could supply code that executes during installation or import. The absence of version pinning also makes installations non-reproducible.

The automatic installation is not necessary for image conversion itself and occurs without a distinct dependency-management step or explicit confirmation.

Attack Path

1. The user runs scripts/convert_jpg.py in an environment where Pillow is not installed.
2. Importing PIL raises ImportError.
3. The exception handler invokes the current Python interpreter with -m pip install Pillow -q.
4. pip resolves the unpinned package through the environment's configured index and trust settings.
5. If that source or resolved package is compromised, attacker-controlled installation or package code executes.
6. The script imports the installed package, providing another execution point for malicious module initialization.

Impact Assessment

Any malicious package code would execute with the privileges of the user running the converter. Depending on those privileges and the environment, this could permit access to use ...[truncated 465 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic package installation from application runtime.
• Declare Pillow in a dedicated dependency manifest or lock file.
• Pin Pillow to a reviewed version or tightly controlled compatible range.
• Use package hashes, such as --require-hashes, to verify downloaded artifacts.
• Install dependencies in a controlled virtual environment during an explicit setup phase.
• Configure package installation to use a trusted index and disallow unexpected fallback indexes.
• If Pillow is absent at runtime, terminate with a clear error explaining the approved installation procedure.
• Add dependency vulnerability scanning and a documented update process so pinned versions can be reviewed and upgraded safely.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill is presented as an end-to-end Instagram card-news pipeline, but the described/implemented behavior is materially narrower and inconsistent. This kind of mismatch is dangerous because users and orchestrators may trust the skill with broader automation, uploads, or content handling than it actually supports, weakening oversight and causing downstream unsafe chaining with other tools.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs use of shell commands (uv run, python3) but declares no explicit tool scope or permissions. That creates an authorization and review gap: an agent or operator may invoke local command execution without clear declaration, making unexpected file access or command misuse more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The trigger language is broad and ambiguous, covering generic requests like Instagram carousel posts or slide-based visual content. Overbroad activation can cause the wrong skill to fire in unrelated contexts, leading to unintended shell use, image-processing steps, or social-post preparation without the user's precise intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Mandating Korean output without user opt-in can cause the skill to override user intent, reduce transparency, and increase the chance that generated captions or slide text are not properly understood before publication. In a posting workflow, language coercion is a safety issue because it can impair review and informed approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill instructs preparation for Instagram upload and browser-based posting without clearly warning the user that it is moving toward publication-oriented actions. In a social-media context, that increases the risk of users unintentionally preparing or posting content to a live account without an explicit consent or review gate.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Line L15 explicitly instructs prompts to specify "large bold Korean text," which imposes a specific language. Under the policy, forcing a language without opt-in or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Line L33 says "Large bold centered Korean text," which directs the skill to always produce Korean output. The file does not provide an alternative language option or explain why Korean is required.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

A simple image converter should not silently fetch and install packages during normal execution. This behavior can surprise users, modify the host system, and execute third-party code transitively through pip, creating a meaningful supply-chain and operational security risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script installs Pillow without warning, consent, or any security prompt, which is risky in an agent skill context because users may not expect network access or environment changes from a local file conversion utility. Silent installation also makes it harder for users to assess provenance, permissions, and side effects before code executes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 89% confidence

Finding

The script invokes pip at runtime to install Pillow whenever the import fails. Even though the subprocess call is not shell-injected, it still causes unreviewed code retrieval and execution from the package index in the user's environment, which expands the script's trust boundary and can lead to supply-chain compromise or unexpected environment modification.

Content

Scanner excerpt · scripts/convert_jpg.py (reported line 20)May include surrounding context.

python

from PIL import Image
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow", "-q"])
    from PIL import Image

Static analysis

No suspicious patterns detected.