Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent image-captioning helper that sends user-selected images to a configured vision API and caches caption results locally, with no evidence of hidden persistence or malicious behavior.
Before installing, confirm you are comfortable sending selected images or batch folders to the configured vision API and leaving caption text in the local cache unless --no-cache is used. Also note that the skill is Chinese-oriented by default and may require SN_API_KEY or related environment variables despite one description claiming no extra API-key setup.
声明描述覆盖了从图片理解到结构化数据处理和导出的完整流程，但所给代码块仅提供 caption.py，其核心能力是把图片发给视觉模型并返回文本描述。虽然提示词针对 chart/table/ui/diagram 做了定制，且支持批量、缓存、压缩、JSON 输出，这些都与“图片理解/描述”部分一致；但声明中的后续数据管道能力（DataFrame 解析、重建图表、导出 Excel/CSV）在代码中完全不存在。另一个实质性偏差是描述称“无需额外配置 API Key”，但代码中 DEFAULT_API_KEY 取自环境变量链，若环境中无 key 则为空，因此并不能从代码证明 truly 无需配置 key。综上，描述明显夸大了实际实现范围，属于能力声明与代码行为不匹配。
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
"""Get the prompt for a given image type, or use custom."""
if custom_prompt:
return custom_prompt
return PROMPTS.get(image_type, PROMPTS["general"])
# ─── Image processing ───────────────────────────────────────────────
Without declared permissions the skill's intent is opaque and cannot be validated.
The section header explicitly states 'Chinese Font Setup (MANDATORY)' and the code configures a Chinese font as the required default for visualization. This is a natural-language locale policy constraint presented as mandatory behavior, with no user choice or justification that the skill is region-specific.
All built-in prompt templates are written in Chinese and instruct the model accordingly, which biases or forces output toward a specific language. There is no natural-language indication that users can choose their preferred language by default, making this a locale/language policy issue.
The manifest explicitly says the skill is only for image understanding/data extraction around charts, tables, screenshots, and diagrams, and specifically says it should not be used for describing landscape/person photos. However, the code includes a "general" prompt that performs unrestricted image description, including subjects, background, colors, and extracted text, enabling broad captioning beyond the declared scope.
The script sends full image contents to an external vision API, which may expose screenshots, tables, or other sensitive visual data to a third party. In this skill context, uploaded images are the primary input and may commonly contain proprietary or personal information, so failing to explicitly disclose remote transmission meaningfully increases privacy and compliance risk.
The manifest centers on using a preconfigured caption script when an image file is the primary input, but the code also supports recursively processing all matching images in a directory and exporting aggregated JSON output. That is an operational expansion beyond the narrowly described single-image assistance workflow, even though still image-related.
For an image-caption skill, the code falls back from vision-specific variables to generic chat credentials and also accepts a caller-supplied API base URL. While remote vision inference is expected, accepting broad credential sources and arbitrary endpoints is not clearly justified by the manifest's narrow, preconfigured 'no extra setup' positioning.
The script persists extracted caption text to a local cache file without clearly informing users that image-derived content will remain on disk. Because captions may contain OCR text or sensitive information extracted from screenshots and documents, silent persistence can lead to unintended local data exposure.
No suspicious patterns detected.