Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Security audit
html-shot
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it claims: renders HTML, SVGs, and URLs into images using local Chromium, with the main risks disclosed.
Install this only if you are comfortable installing Node dependencies plus Playwright Chromium. Use it on your own HTML or URLs you trust; pages rendered by Chromium can run JavaScript and contact the network. Avoid pointing it at untrusted HTML, especially when your machine has access to private services or local-only resources.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (32)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `render.mjs` | one design → **one image** (og card, badge, element, page, SVG) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `icons.mjs` | one design → **a favicon or app-icon set** (`.ico`/`.icns`/apple-touch/PWA) |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `icons.mjs` | one design → **a favicon or app-icon set** (`.ico`/`.icns`/apple-touch/PWA) |
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!doctype html> <!-- html-shot starter template: a transparent, square mark — an app icon, a favicon master, a badge. The counterpart to template.example.html, which is an opaque 1200x630 card.
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!doctype html> <!-- html-shot starter template: a 1200x630 social card. System fonts only, so it renders out of the box with no /fonts directory.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
npx skills add rockbenben/aishort-skills
text Or clone this repo and copy (or symlink) `skills/html-shot/` into your agent's skills folder — `~/.claude/skills/` for Claude Code, `~/.agents/skills/` for the cross-runtime convention Codex and Gemini CLI also read, or wherever your agent keeps them.
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
First run only — install the engine:
bash # $SKILL_DIR = wherever the skill landed (Claude Code: ~/.claude/skills/html-shot) SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger examples are broad ordinary-language phrases like "turn this design into a 2x og image" and "screenshot the hero section of that page," which can cause the skill to activate in routine conversation rather than only when explicitly intended. Over-broad triggering increases the chance the agent invokes a capability that executes local Chromium against user-supplied HTML/URLs, expanding exposure to unsafe content or unintended network access.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The early capability description presents the skill as a convenient HTML/URL/SVG-to-image renderer without prominently warning that rendering HTML in Chromium executes JavaScript and can initiate outbound requests. Although a warning appears later, surfacing the capability before the risk can mislead users into treating untrusted input as safe, increasing SSRF, data exfiltration, or local-environment exposure risk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
仅首次运行 —— 装引擎：
bash # $SKILL_DIR = skill 实际所在目录（Claude Code 为 ~/.claude/skills/html-shot） SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
仅首次运行 —— 装引擎:
bash # $SKILL_DIR = skill 实际所在目录(Claude Code 为 ~/.claude/skills/html-shot) SKILL_DIR=~/.claude/skills/html-shot cd "$SKILL_DIR" && npm install && node node_modules/playwright/cli.js install chromium
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The auto-trigger phrases are broad natural-language descriptions like '生成 og 图' and '网页截图', which can overlap with ordinary conversation and cause the skill to activate unexpectedly. In this skill's context, unintended activation is more dangerous because the tool can render HTML/URLs and may execute page JavaScript and make network requests.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill explicitly supports rendering arbitrary URLs and states that HTML genuinely executes in Chromium with outbound requests enabled, which gives it effective network capability. Because the manifest declares no tool scope or allowed-tools restrictions, an agent may invoke a network-capable skill without clear authorization boundaries, increasing the chance of SSRF-style access, unintended external fetches, or data exfiltration through rendered pages.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md 1. **First run only** — install the engine (below). If it is already installed, `render.mjs` just works; if it is not, the script exits with the exact install command to run. 2. **Write or copy the HTML.** Two starters, and they size themselves differently on purpose: - `template.example.html` — a card. `body` gets an explicit `width`/`height` in px and the output size flows from there. - `icon.example.html` — a transparent mark or app icon. The shape sits on a **child**
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
node {SKILL_DIR}/node_modules/playwright/cli.js install --with-deps chromium
2. CJK + emoji system fonts, or non-Latin text renders as tofu boxes (□□□)
sudo apt install fonts-noto-cjk fonts-noto-color-emoji # Debian/Ubuntu
text `{SKILL_DIR}` is this skill's own directory — whatever path the agent reports when it loads
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
These lines explicitly say output for CJK text depends on the machine's locale if no
langis provided. That implies language/locale-sensitive behavior can be imposed implicitly rather than by an explicit user choice, which falls under the locale policy concerns for natural-language content.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | An absolutely-positioned element drifts off the card | `position:absolute` resolves against the viewport unless an ancestor is positioned. Put `position:relative` on `body` (the starter template does). | | Works locally, 404s in Linux CI | A reference whose case does not match the file on disk. Windows/macOS match case-insensitively, Linux does not — the render prints `note — /IMG/A.PNG is spelled /img/a.png on disk` when it spots one. | | `browserType.launch` fails on Alpine / `node:*-alpine` | Playwright has no musl Chromium build. Switch the image to a glibc base (`node:22-slim`, `node:22-bookworm`). | | CJK/emoji come out as tofu boxes (□□□) — Linux only | The machine has no CJK/emoji font. `sudo apt install fonts-noto-cjk fonts-noto-color-emoji`, or reference a bundled webfont so the card no longer depends on the host. | | `browserType.launch` fails with "Host system is missing dependencies" — Linux only | Chromium's shared libs are absent: `node {SKILL_DIR}/node_modules/playwright/cli.js install --with-deps chromium`. | | Han characters look subtly wrong — Japanese text drawn with Chinese shapes, or vice versa | `<html lang="…">` selects the CJK fallback font. Set it to the content's language (`zh-CN`, `zh-TW`, `ja`, `ko`); with no `lang` the result follows the rendering machine's locale. | | The same HTML looks different on another machine | System fonts differ across Windows/macOS/Linux, and `lang` steers CJK fallback. For byte-comparable output in CI, set `lang` and bundle a webfont via `@font-face` instead of relying on `system-ui`. |
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- icons.mjs:250