Security audit

Baoyu Infographic

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed infographic-generation workflow with some prompt-integrity caveats when used on untrusted content.

Install is reasonable if you want an infographic workflow. Review generated prompts and images before publishing, and be cautious when running it in repositories that contain a project-local EXTEND.md or when transforming documents from untrusted sources, because such content could influence the generated infographic.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/base-prompt.md:35
Finding: Untrusted Content Is Inserted into Downstream Image-Generation Prompts Without Isolation
Content: View full analysis
.md` 2. Style definition from `references/styles/.md` 3. Base template from `references/base-prompt.md` 4. Structured content from Step 2 5. All text in confirmed language **Aspect ratio resolution** for `{{ASPECT_RATIO}}`: ``` The Skill also directs the Agent to load project- or user-controlled extension configuration in `SKILL.md:146-177`: ```markdown **1.1 Load Preferences (EXTEND.md)** Check EXTEND.md existence (priority order): ```ba ...[truncated 3870 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill metadata advertises broad trigger phrases such as "infographic", "visual summary", and especially the generic Chinese term "可视化", which can overlap with many ordinary user requests. This can cause the skill to activate in contexts where the user did not explicitly want this workflow, increasing the chance of unintended file access, content transformation, or prompting behavior from the agent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction 'Use the specified language for all text content' imposes a language constraint in natural language. Because the prompt does not mention user choice, opt-in, or a justified region-specific requirement, it may conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The subtitle guidance includes a Chinese-only example string ("X大维度全面解析...") as the prescribed text pattern. This can be read as enforcing a specific language/locale in the output without any opt-in or alternative language guidance, which is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The instruction "All content text in specified language" imposes a language constraint but does not indicate that the user can choose or opt into that language. Under the stated policy, forced language behavior without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.