Security audit

Macaron Card Generator

Security checks for vulnerabilities and agentic risk

Overview

This card generator is coherent in purpose, but it needs Review because untrusted card text can become active HTML or JavaScript during screenshot rendering.

Install only if you will render cards from trusted content or can isolate the screenshot browser. Safer use requires escaping all text fields, adding a restrictive Content Security Policy, blocking network access during rendering, and keeping outputs inside a controlled workspace path.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/generate_card.py:184
Finding: Unescaped User Content Allows Active HTML and JavaScript Injection
Content: View full analysis
{stars}' tags_html = "" if tags: tags_html = '
' + \ ''.join(f'{t}' for t in tags) + '
' body = f"""
{author}
{rating_html}

📖 {cover_desc}

{('
💡 Reason to read：' + reason + '
') if reason else ''} {('
📝 Key takeaway：' + takeaway + '
') if ta ...[truncated 5566 chars]
Remediation: View remediation
``` 5. **Isolate screenshot rendering.** Use a temporary browser profile, disable unnecessary browser permissions, block all network requests, avoid permissive local-file-access flags, and destroy the browser context after each card. 6. **Add security regression tests.** Test every text and list field with payloads containing `

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description says the skill generates card images, but the documented workflow actually generates HTML and then requires a separate browser-based screenshot step to produce a PNG. This mismatch can mislead routing and trust decisions, causing the agent or user to approve capabilities like script execution, file creation, or browser rendering that were not clearly disclosed in the skill's stated purpose.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to run a script that writes an output HTML file, but the manifest does not declare any tool scope or allowed-tools restrictions. This creates unnecessary ambiguity around what filesystem-capable tools the skill may invoke and weakens least-privilege controls, which can enable unintended file writes or broader tool access if the skill is auto-routed.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger words include broad phrases like 'generate image' and 'create an image,' which overlap with many generic user requests unrelated to this specific card generator. Overbroad triggers increase the chance of accidental invocation, causing the agent to run file-writing and browser-rendering workflows in contexts where the user did not intend to use this skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill for generating card images, including multiple card types and aspect ratios. In this implementation, the script builds HTML markup and writes it to an output file, with no image rendering or export step present in the code.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The generated HTML hard-codes lang="zh-CN", which imposes a specific language/locale on all output regardless of user preference. This is a natural-language policy concern because the file provides no opt-in, locale selection mechanism, or justification that the skill is region-specific.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.