Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
html-shot
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed local image-rendering tool, with expected browser and file-output behavior for its purpose.
Install only if you are comfortable with a local Chromium-based renderer. Do not render HTML you do not trust, because page JavaScript can run and make outbound requests, and local assets under the input/base directories can be exposed to that page during rendering. Review optional npm, npx, and sudo setup steps before running them.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (30)
Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `icons.mjs` | one design → **a favicon or app-icon set** (`.ico`/`.icns`/apple-touch/PWA) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `icons.mjs` | one design → **a favicon or app-icon set** (`.ico`/`.icns`/apple-touch/PWA) |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Hidden Instructions
High
- Category
- Prompt Injection
- Content
<!doctype html> <!-- html-shot starter template: a transparent, square mark — an app icon, a favicon master, a badge. The counterpart to template.example.html, which is an opaque 1200x630 card.
- Confidence
- 70% confidence
- Finding
- Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Hidden Instructions
High
- Category
- Prompt Injection
- Content
<!doctype html> <!-- html-shot starter template: a 1200x630 social card. System fonts only, so it renders out of the box with no /fonts directory.
- Confidence
- 70% confidence
- Finding
- Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
npx skills add rockbenben/aishort-skills ``` Or clone this repo and copy (or symlink) `skills/html-shot/` into your agent's skills folder — `~/.claude/skills/` for Claude Code, `~/.agents/skills/` for the cross-runtime convention Codex and Gemini CLI also read, or wherever your agent keeps them.
- Confidence
- 85% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
**First run only** — install the engine: ```bash # $SKILL_DIR = wherever the skill landed (Claude Code: ~/.claude/skills/html-shot) SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium ```
- Confidence
- 85% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Vague Triggers
Medium
- Confidence
- 93% confidence
- Finding
- The README advertises activation from broad natural-language prompts such as "turn this design into a 2x og image" or "screenshot the hero section of that page" without clear scoping or confirmation boundaries. In agent environments, broad trigger phrases can cause unintended invocation on untrusted HTML or URLs, which is especially risky here because the README explicitly states the skill executes HTML in Chromium with JavaScript and outbound requests enabled.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
- npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
**仅首次运行** —— 装引擎： ```bash # $SKILL_DIR = skill 实际所在目录（Claude Code 为 ~/.claude/skills/html-shot） SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium ```
- Confidence
- 85% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Content
**仅首次运行** —— 装引擎: ```bash # $SKILL_DIR = skill 实际所在目录(Claude Code 为 ~/.claude/skills/html-shot) SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium ```
- Confidence
- 85% confidence
- Finding
- Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Vague Triggers
Medium
- Confidence
- 95% confidence
- Finding
- The auto-trigger examples are broad enough to match common user requests such as generating OG images or screenshots, which can cause the skill to activate in situations the user did not explicitly intend. Because this skill executes local rendering workflows and may process URLs/HTML with active browser behavior, over-broad triggering increases the chance of unintended execution on sensitive or untrusted content.
Missing User Warnings
Medium
- Confidence
- 97% confidence
- Finding
- The README warns that HTML executes in local Chromium and may make external requests, but it does not clearly and prominently warn that rendering arbitrary URLs or HTML can trigger network access to third-party hosts and leak request metadata or locally referenced resources. In a browser-rendering skill, this omission is important because users may assume rendering is purely local while the browser fetches remote assets, follows redirects, or loads attacker-controlled content.
Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
- The skill explicitly supports rendering arbitrary URLs and states that Chromium will make outbound requests, but the manifest declares no tool scope or network restrictions. That mismatch matters because the skill can fetch remote content and execute page JavaScript, creating a broader attack surface than the metadata communicates to the agent or operator.
Vague Triggers
Medium
- Confidence
- 92% confidence
- Finding
- The description says the skill 'Triggers on 生成 og 图 / 网页截图 / favicon / 应用图标', which includes short everyday phrases like '网页截图' and 'favicon' that could match many ordinary requests. It does not define scope constraints or negative examples, so the activation conditions are ambiguous and may cause unintended invocation.
Session Persistence
Medium
- Category
- Rogue Agent
- Content
1. **First run only** — install the engine (below). If it is already installed, `render.mjs` just works; if it is not, the script exits with the exact install command to run. 2. **Write or copy the HTML.** Two starters, and they size themselves differently on purpose: - `template.example.html` — a card. `body` gets an explicit `width`/`height` in px and the output size flows from there. - `icon.example.html` — a transparent mark or app icon. The shape sits on a **child**- Confidence
- 60% confidence
- Finding
- Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Content
node {SKILL_DIR}/node_modules/playwright/cli.js install --with-deps chromium # 2. CJK + emoji system fonts, or non-Latin text renders as tofu boxes (□□□) sudo apt install fonts-noto-cjk fonts-noto-color-emoji # Debian/Ubuntu ``` `{SKILL_DIR}` is this skill's own directory — whatever path the agent reports when it loads- Confidence
- 70% confidence
- Finding
- Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Content
node {SKILL_DIR}/node_modules/playwright/cli.js install --with-deps chromium # 2. CJK + emoji system fonts, or non-Latin text renders as tofu boxes (□□□) sudo apt install fonts-noto-cjk fonts-noto-color-emoji # Debian/Ubuntu ``` `{SKILL_DIR}` is this skill's own directory — whatever path the agent reports when it loads- Confidence
- 70% confidence
- Finding
- Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Content
if (want.has("pwa") && presetName === "next") fail(`the PWA pair cannot share an output directory with --preset next: these two files belong in public/, but the next preset writes App Router convention names into app/. Build them separately:\n node icons.mjs ${source} public --only pwa`); // The default needs no checking, so all of this is about a --bg the user actually passed. const bg = opts.bg ?? "#ffffff"; if (opts.bg) { // Same rule as --small: what decides whether --bg does anything is whether THIS run writes- Confidence
- 75% confidence
- Finding
- Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- icons.mjs:250