Instagram Photo Text Overlay

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:07 PM UTC
• Version: 1.0.0

Overview

This skill is a local image-overlay tool with disclosed options; its main caveats are a default third-party watermark and an unpinned Pillow install instruction.

Before installing, know that generated images include a `tabiji.ai` watermark by default unless the agent passes an empty `--watermark`; use a virtual environment and a pinned Pillow version if reproducible installs matter.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Note

• Location: scripts/overlay.py:285
• Finding: Third-Party Promotional Watermark Enabled by Default<![CDATA[ ## Vulnerability Details **File Location**: `scripts/overlay.py:285` **Additional Locations**: `SKILL.md:29`, `scripts/overlay.py:139-141`, `scripts/overlay.py:209-211`, `scripts/overlay.py:246-248` **Vulnerability Type**: Unwanted third-party content injection **Risk Level**: Low ### Vulnerable Code ```python p.add_argument("--watermark", default="tabiji.ai", help="Top-left watermark text") ``` The default is subsequently rendered by every supported layout: ```python if watermark: draw.text( (margin, int(H * 0.03)), watermark, font=get_font(fp, int(W * 0.03)), fill=(255, 255, 255, 200), ) ``` ### Technical Analysis The command-line parser assigns the unrelated domain `tabiji.ai` as the default watermark. Unless a caller explicitly passes an empty `--watermark` value, the rendering functions permanently embed that promotional text into the generated image. The default is documented in `SKILL.md`, and the behavior can be disabled, so it is not covert or irreversible. Nevertheless, opt-out third-party branding is unnecessary for the stated image-overlay function and can cause an agent to produce promotional content that the user did not expressly request. This does not alter the agent's instructions, obtain system privileges, or execute attacker-controlled code. It therefore does not accurately fit T01 through T09 and is classified as an additional event type. ### Attack Path 1. A user asks the agent to create a social-media image. 2. The agent invokes `overlay.py` without overriding `--watermark`. 3. `argparse` assigns `tabiji.ai` to `args.watermark`. 4. The selected rendering function draws the domain in the upper-left corner. 5. The branded output is saved and may be published without the user noticing the third-party promotion. ### Impact Assessment No operating-system privileges, credentials, or persistent access can be obtained through this behavior. The impact is limited to generated output an ...[truncated 207 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Make watermarking opt-in by changing the default to an empty string: ```python p.add_argument( "--watermark", default="", help="Optional top-left watermark text", ) ``` Also update `SKILL.md` to state that no watermark is applied unless the user explicitly requests one. If branded output is required for a particular deployment, obtain explicit user consent and expose the selected watermark in the agent's response before generating the image. ]]>

T08 · Insecure Dependencies

Note

• Location: SKILL.md:49
• Finding: Unpinned Pillow Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:49-53` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Low ### Vulnerable Code ```markdown ## Requirements - Python 3 + Pillow (`pip install Pillow`) - Works on macOS (Helvetica) and Linux (DejaVu/Liberation fallback) ``` ### Technical Analysis The setup documentation recommends installing Pillow without a version constraint, lockfile, package hash, or isolated-environment guidance: ```bash pip install Pillow ``` This causes the resolved dependency to vary over time. Although the audit found no suspicious package name, custom package index, dependency confusion mechanism, or currently malicious dependency, the mutable installation instruction weakens reproducibility and leaves future installations dependent on the integrity and compatibility of the latest registry release. Exploitation requires an external supply-chain event, such as compromise of the upstream package or its distribution channel. The project itself does not retrieve or execute a remote payload directly. ### Attack Path 1. A user follows the documented installation command. 2. `pip` queries its configured package index and resolves the current Pillow release rather than a previously reviewed version. 3. If the selected distribution or package index has been compromised, `pip` downloads the attacker-controlled artifact. 4. Installation or subsequent import executes the compromised dependency under the privileges of the user running the command. 5. The malicious package could access data and resources available to that user. This path is conditional on upstream or registry compromise; no evidence of such a compromise was present in the audited project. ### Impact Assessment Under a successful supply-chain compromise, code could execute with the privileges of the account installing or running the Skill. The accessible scope could include that account's files, environment variables, network access, a ...[truncated 258 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin Pillow to a reviewed version in a requirements file: ```text Pillow==<reviewed-version> ``` 2. Generate and verify cryptographic hashes, for example by using a hash-locked requirements file and: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Install the dependency inside a dedicated virtual environment rather than the system Python environment. 4. Use the canonical package index over TLS and avoid untrusted extra indexes. 5. Add a controlled dependency-update process that includes vulnerability scanning, compatibility tests, and review before changing the pinned version. ]]>

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Description-Behavior Mismatch

Low

• Confidence: 90% confidence
• Finding: The manifest describes generating Instagram images with gradient overlays, titles, and optional numbered lists for itineraries or top-5 style content. The code additionally implements a dedicated quote layout with quote text and author attribution, which is a broader content type than the manifest advertises.

Static analysis

No suspicious patterns detected.