Security audit

Baoyu Article Illustrator

Security checks for vulnerabilities and agentic risk

Overview

This skill coherently creates illustrations for articles and edits local article/workflow files in ways that match its stated purpose, with no evidence of hidden execution, exfiltration, or system persistence.

Install this if you want an agent to generate article illustrations and update local markdown. Expect it to create output folders, prompts, outlines, reference copies, backups, image files, and possibly persistent EXTEND.md preferences; choose project-scoped preferences and a copy/update option carefully if you do not want source articles changed directly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "add images" is generic and can match many ordinary editing requests that do not necessarily imply article-illustration workflow or file modification. Over-broad activation can cause the skill to run in unintended contexts, leading to unwanted file creation, content insertion, or routing to a more invasive workflow than the user expected.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill performs state-changing actions: it saves outline and prompt files, generates image files, and inserts markdown image references into the article, but the description does not clearly disclose these modifications up front. In practice, users may invoke the skill expecting analysis or suggestions only and instead get persistent filesystem changes and edits to article content.

Session Persistence

Medium

Category: Rogue Agent
Content: │ ▼ ┌─────────────────────┐ │ Create EXTEND.md │ └─────────────────────┘ │ ▼
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The workflow instructs modifying the user's article by inserting image links, which goes beyond a narrow interpretation of 'analyzes article structure' and can alter source content. Because the edit is persistent and occurs without an explicit pre-edit warning or confirmation at the moment of write, it increases the risk of unintended document changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow modifies the article file by inserting markdown image links without an explicit warning immediately tied to that write operation. Direct source-document edits are more sensitive than creating auxiliary files because they can affect published content, version history, and downstream processing.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The workflow copies user-supplied reference images into a local references directory without an explicit user-facing notice that a file write will occur. While expected for this feature, silent writes can surprise users and create unwanted local artifacts or duplicate sensitive images.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The workflow saves extracted style information to a new file without clearly warning the user that a new artifact will be created. Even though the content is low sensitivity, undisclosed writes reduce transparency and may persist derived information the user did not expect to store.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: Renaming an existing source file to create a backup changes the user's workspace state and can interfere with existing automation or references if done without explicit consent. Although intended as data protection, it is still a filesystem modification that should be disclosed before execution.

Context-Inappropriate Capability

Low

Confidence: 83% confidence
Finding: The skill's stated purpose is to analyze an article and generate illustrations, but this workflow explicitly probes multiple global configuration locations including paths derived from $HOME and XDG variables. Reading project-local preferences is expected, but traversing user-scoped config locations and environment-based paths is a broader capability not clearly justified by the manifest's narrow illustration purpose.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The workflow creates outline and prompt files and may rename existing ones for backup without explicitly informing the user. These are legitimate workflow artifacts, but undisclosed creation and renaming of files can still be unsafe in environments where workspace contents matter or are monitored by automation.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The workflow backs up and replaces image outputs during generation without explicit disclosure, which can overwrite or reshuffle user-managed assets. This is a transparency and safety issue rather than a high-severity exploit, but it can still cause confusion or unwanted changes.

Static analysis

No suspicious patterns detected.