妙达文字生成图片

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:39 AM UTC
• Version: 1.0.0

Overview

This is a coherent image-generation prompt helper, with some install and privacy caveats but no evidence of hidden or malicious behavior.

Before installing, review the npm package and prefer a pinned or local install if possible. Avoid putting sensitive, private, or regulated information into image prompts unless you trust the miaoda-studio-cli service and its data handling.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:160

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 160-167
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable Code

bash

# Install if not already installed
npm install -g miaoda-studio-cli

# Verify installation
miaoda-studio-cli --version

Technical Analysis

The Skill instructs users to install miaoda-studio-cli globally from the npm registry without specifying a reviewed version, integrity hash, lockfile, or package provenance. Consequently, the installed code is determined by whichever package release the registry resolves at installation time and may differ from the version originally reviewed by the Skill author.

npm installations may execute package lifecycle scripts, including pre-installation, installation, and post-installation scripts, with the privileges of the invoking user. The global installation option also places package files and executable entry points in the global Node.js environment, increasing their reach beyond the project directory.

No evidence in the reviewed project establishes that miaoda-studio-cli is currently malicious. The issue is the unsafe and mutable dependency acquisition process, which creates a supply-chain exposure if the package, its maintainer account, the registry resolution process, or a transitive dependency is compromised.

Attack Path

1. An attacker compromises the referenced npm package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the Skill instructions and runs npm install -g miaoda-studio-cli.
4. npm resolves the unpinned package to the attacker-controlled release.
5. Malicious package code may run through npm lifecycle scripts during installation or when the installed CLI is subsequently invoked.
6. The payload operates with the invoking user’s privileges and can a ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specific reviewed version, such as miaoda-studio-cli@X.Y.Z, rather than installing the latest mutable release.
2. Verify package provenance, publisher identity, release signatures where available, and the expected integrity digest before installation.
3. Document the exact reviewed package version and its expected checksums.
4. Prefer a project-local dependency managed through a committed lockfile instead of a global installation.
5. Review both the direct package and its transitive dependency tree for suspicious lifecycle scripts and known vulnerabilities.
6. Disable lifecycle scripts during installation with --ignore-scripts when the package can operate without them.
7. Run the CLI in a restricted environment with minimum filesystem, credential, and network access.
8. Document the CLI’s network destinations, transmitted data, generated files, and credential requirements so users can make an informed trust decision.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes very broad everyday phrases such as '生成图片', '画图', '做一张图', and 'generate image', which can cause the skill to activate unintentionally in normal conversation. Overbroad activation increases the chance that user text is routed to this skill unexpectedly, potentially sending prompts to an external image-generation tool without clear user intent or consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to submit detailed prompts to an external CLI-based image generation tool but does not warn that prompts may be transmitted to a third-party service or influence generated outputs in unexpected ways. This creates a privacy and transparency risk because users may include personal, sensitive, or proprietary information in prompts without understanding where that data goes or how it is processed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L003 的技能描述完全以中文撰写，并面向通用图片生成场景，没有说明该技能仅限中文用户或特定地区使用，也未提供语言选择或用户自定义选项。根据语言/地区政策，通用技能若隐含强制单一语言而无用户选择，属于自然语言层面的合规风险。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.