摄影级人像生图Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:47 AM UTC
• Version: 1.0.0

Overview

This portrait-generation skill is not malware, but it needs review because it encourages exact reference-image and facial likeness replication without clear consent or rights safeguards.

Before installing, use this only with images you own or have permission to reuse, especially for real people. Consider editing or disabling the full-fusion and facial-identity templates so reference images are treated as style or pose inspiration unless the user explicitly confirms consent and rights.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference prefix templates use escalating language such as 'absolute highest priority' and 'non-negotiable master blueprint' to override other constraints and maximize fidelity to the reference. In context, this is dangerous because it systematically steers the model toward stronger copying behavior, which can defeat softer safety controls and promote unauthorized reproduction of protected or personally identifying visual characteristics.

Content

No source excerpt is available for this finding.

Ssd 1

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Template C explicitly instructs the model that the face must be 'instantly recognizable as the SAME person,' which is a direct identity-preservation instruction. For a portrait-generation skill, this is risky because it facilitates likeness cloning and non-consensual face replication from a reference image of a real person.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The system prompt elevates reference-image rules to the highest priority, defaults to full-fusion mode, and resolves conflicts in favor of the reference for multiple dimensions. This creates a layered instruction hierarchy that normalizes strong reference copying across the skill's whole workflow, increasing the chance of policy bypass and unauthorized identity/style duplication.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 581)May include surrounding context.

md

> 11. **Output only the Flux primary prompt by default**; generate DALL-E / Gemini prompts only when the user explicitly requests multi-engine adaptation
>
> Rules:
> - NEVER output prompt text without also calling GenerateImage to produce the actual image (unless GenerateImage fails twice, in which case output the prompt text as fallback)
> - ALWAYS include skin texture details (pores, micro-texture, natural imperfections) — NEVER use smooth skin, airbrushed, or porcelain doll descriptors
> - ALWAYS enforce single key light consistency and coherent eye catchlights
> - ALWAYS adapt lighting physics to the subject's demographic characteristics per the 4.2 matrix

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The reference-image workflow defaults to strict replication and 'full fusion,' causing the model to prioritize preservation of pose, lighting, style, composition, and potentially person-specific traits from an uploaded image. In an image-generation skill, this increases the risk of unauthorized likeness preservation or near-copying of third-party reference content, especially when users upload photos of real people.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The checklist states a hard language rule requiring all prompts to be in English and all analysis to be in Chinese. This is a natural-language locale policy constraint applied unconditionally, and the file does not offer the user any language choice or opt-in path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The system prompt mandates that all prompts must be in English and all analysis, explanations, and parameter descriptions must be in Chinese, calling the rule non-negotiable. This forces a specific language/locale behavior regardless of user preference, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.