T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:145- Finding
Mandatory Third-Party Branding Directives Manipulate Generated Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Algorithmic Art
Security checks for vulnerabilities and agentic risk
Overview
The skill is mainly a p5.js generative-art helper, but it forces Anthropic-styled branding into generated artifacts and uses remote browser code without integrity checks.
Review this skill before installing if you do not want generated work to preserve Anthropic-styled UI. For shared or hosted artifacts, consider removing the branding requirements and adding SRI or vendored copies for p5.js and fonts, especially if the HTML will be hosted alongside sensitive same-origin content.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
templates/viewer.html:23- Finding
Remote JavaScript Dependency Executes Without Integrity Verification
- Content
View full analysis
``` The skill documentation instructs generated artifacts to use the same dependency: ```html /* All styling inline - clean, minimal */ /* Canvas on top, controls below */ ``` ### Technical Analysis The HTML template loads executable JavaScript from a third-party CDN at runtime. Although the dependency uses HTTPS and pins p5.js to version `1.7.0`, it does not use a Subresource Integrity hash. The document also does not define a restrictive Content Security Policy. Consequently, the browser trusts and executes whatever bytes are returned for the CDN URL. Pinning a version prevents routine version drift, but it does not cryptographically verify the response. A compromise of the CDN account, hosting infrastructure, DNS or certificate trust path, or another part of the delivery chain could substitute malicious JavaScript. The template also loads Google-hosted fonts from `fonts.googleapis.com` and `fonts.gstatic.com`. Those requests disclose ordinary connection metadata and mean the artifact is not fully self-contained, contrary to the documentation's description. The JavaScript dependency presents the greater risk because its response executes as code. ### Attack Path 1. An artifact is generated from `templates/viewer.html`. 2. A user opens the artifact in a browser while network access is available. 3. The browser requests p5.js from `cdnjs.cloudflare.com`. 4. An attacker who has compromised an effective part of the dependency delive ...[truncated 1313 chars]- Remediation
View remediation
``` 3. Obtain the integrity value from a trusted source and independently verify it against the reviewed p5.js release before deployment. 4. Add a restrictive Content Security Policy that permits scripts only from explicitly approved sources and blocks unnecessary dynamic execution. 5. Vendor fonts locally or use safe local font fallbacks to make artifacts genuinely self-contained and avoid third-party metadata disclosure. 6. Establish a dependency-review process for updating p5.js, including checksum verification and security review. 7. Update `SKILL.md` so generated artifacts inherit these protections rather than reproducing the unsafe remote script pattern. ]]>
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest description says to use this skill when users request 'creating art using code' or 'generative art,' which are broad, natural phrases that could match many unrelated creative coding requests. The file does not provide clear trigger boundaries, exclusions, or negative examples to limit when the skill should or should not activate.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill explicitly instructs the agent to read and reuse a branded HTML template verbatim and preserve fixed Anthropic-specific UI, fonts, colors, and structure. That creates a scope/identity risk: a skill intended for algorithmic art generation is also directing reproduction of proprietary-looking branding and exact product chrome, which can mislead users about endorsement and causes the model to copy non-user-authored template content beyond the core art logic.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The top-level description emphasizes originality to avoid copying existing artists' work. Later instructions explicitly require literal reuse of template HTML and unchanged branded UI sections, which conflicts with that originality framing at the documentation level even if the generative algorithm itself is meant to be unique.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The comments describe concrete functionality such as a p5.js generative art algorithm, particle system, and UI control handlers, but the corresponding functions and class bodies are placeholders with 'fill this in'. This is more than incomplete documentation because the file presents these sections as existing behavior while the code does not actually implement them.
- Content
Static analysis
No suspicious patterns detected.