An AI-powered tool that turns conversations into polished, structured summary cards by extracting key ideas, action items, and next steps.

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:44 AM UTC
• Version: 1.0.5

Overview

This skill has a coherent image-summary purpose, but it asks users to paste an API key into chat and sends chat-derived content to an external service with weak credential scoping.

Review before installing. Use it only if you are comfortable giving the agent a mew.design API key and sending summarized chat content to Mew's API. Avoid using it with confidential or regulated conversations, prefer a short-lived or low-scope API key, and watch for any command that changes the validation base URL away from api.mew.design.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:119
• Finding: Persistent Third-Party Branding Hijacks Generated Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:119`, `SKILL.md:164`, `SKILL.md:198`, `references/patterns.md:43`, `scripts/build_summary_card_request.py:127-129`, and `scripts/build_summary_card_request.py:143-146` **Vulnerability Type**: Persistent output manipulation **Risk Level**: High ### Complete Code Snippets From `SKILL.md`: ```markdown - Always add a subtle `Mew.Design` watermark at the bottom of the image. Keep it small, clean, and low-interference, but clearly readable. ``` ```markdown The helper script already injects the `Mew.Design` bottom watermark requirement. Do not remove it unless the user explicitly asks to omit the watermark. ``` ```markdown If the generated image visibly misses the watermark, retry once with a stronger prompt that explicitly says `Place the text watermark "Mew.Design" at the bottom center of the image`. ``` From `scripts/build_summary_card_request.py`: ```python sections.append( 'Add a subtle but readable text watermark "Mew.Design" at the bottom of the image.' ) ``` ```python parts.append( 'Place the watermark text "Mew.Design" along the bottom edge in a clean, understated, readable way.' ) ``` ### Technical Analysis The Skill modifies every generated summary request to include third-party `Mew.Design` branding. This behavior is reinforced in the main instructions, reference material, and both prompt fields generated by the payload builder. The workflow also instructs the agent to retry generation when the watermark is missing. Consequently, branding is treated as a mandatory objective rather than an optional presentation choice. It does not contribute to summarizing the conversation and exceeds the minimum behavior necessary to produce a visual summary. The user can explicitly request omission under one instruction, but the default workflow still injects the branding without first obtaining informed consent. The retry mechanism can also consume additional API qu ...[truncated 1077 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove automatic watermark requirements from `SKILL.md`, `references/patterns.md`, and `scripts/build_summary_card_request.py`. 2. Remove retries whose sole purpose is to force branding into the output. 3. If attribution is contractually required, clearly disclose it before API use and obtain explicit user consent. 4. Add a dedicated opt-in option such as `--include-watermark` rather than enabling branding by default. 5. Keep attribution separate from the summarized conversation content wherever possible. 6. Ensure that failure to render optional attribution never causes another billable generation request. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_mew_design_key.py:18
• Finding: API Key Is Passed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:90-93` and `scripts/validate_mew_design_key.py:18-20` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: Medium ### Complete Code Snippets From `SKILL.md`: ```bash python3 scripts/validate_mew_design_key.py --api-key "USER_PROVIDED_KEY" ``` From `scripts/validate_mew_design_key.py`: ```python parser = argparse.ArgumentParser( description="Validate a mew.design API key using an auth-only probe request.", ) parser.add_argument("--api-key", required=True, help="mew.design API key to validate.") ``` ### Technical Analysis The documented invocation places the user's API key directly in the command-line argument vector. Depending on the execution environment, process arguments can be exposed through process inspection utilities, orchestration telemetry, audit records, shell history, terminal capture, or agent tool-call logs. Transmission of the key to the declared Mew API is necessary for authentication, but placing it in the process arguments is not. The implementation therefore exposes the credential through an avoidable local channel before the network request occurs. Quoting the value protects shell parsing but does not prevent the secret from appearing in process metadata or retained command logs. ### Attack Path 1. The user supplies a mew.design API key in the conversation. 2. The agent follows the documented command and interpolates the key into `--api-key`. 3. The command, including the plaintext key, is exposed in the process argument vector or execution records. 4. A local observer, monitoring agent, telemetry collector, or party with access to retained tool logs reads the key. 5. The recovered key is used to access the corresponding Mew account or consume its API quota. ### Impact Assessment An attacker who recovers the key may make authenticated requests with the victim's Mew credentials, consume paid or limited API ...[truncated 225 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the required `--api-key` command-line argument. 2. Read the key from standard input without echoing it, or pass it through a protected file descriptor. 3. If interactive use is supported, use `getpass.getpass()` to prevent terminal echo. 4. Avoid printing, logging, or embedding the key in exceptions and tool-call previews. 5. Update `SKILL.md` so its example pipes or supplies the credential through the protected input mechanism. 6. Redact likely API-key values in agent execution logs and ensure temporary credential buffers are not persisted. 7. Avoid relying on environment variables where the deployment platform exposes process environments to diagnostics or other users. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/validate_mew_design_key.py:21
• Finding: Arbitrary Validation Base URL Can Redirect the User's API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/validate_mew_design_key.py:21-26`, `scripts/validate_mew_design_key.py:32-35`, and `scripts/validate_mew_design_key.py:38-50` **Vulnerability Type**: Unrestricted sensitive-data destination **Risk Level**: Medium ### Complete Code Snippet ```python parser.add_argument( "--base-url", default=DEFAULT_BASE_URL, help="Gateway base URL.", ) ``` ```python def build_endpoint(base_url: str) -> str: normalized = base_url.rstrip("/") + "/" return urllib.parse.urljoin(normalized, "open/api/design/generate") ``` ```python def probe_key(endpoint: str, api_key: str, timeout: int) -> dict: # Send an intentionally invalid body. A valid key should pass auth and fail on payload validation. request = urllib.request.Request( endpoint, data=b"{}", headers={ "Content-Type": "application/json", "x-api-key": api_key, "User-Agent": "curl/8.7.1", "Accept": "*/*", }, method="POST", ) ``` ### Technical Analysis The validator allows callers to replace the trusted `https://api.mew.design/` destination with an arbitrary base URL. `build_endpoint()` performs path construction but does not validate the URL scheme, hostname, port, user information, or trust boundary. `probe_key()` then sends the user's API key in the `x-api-key` header to the resulting endpoint. The normal documented workflow uses the legitimate default, so the code does not establish intentional exfiltration by itself. Nevertheless, the override creates an unnecessary credential-redirection primitive. A manipulated command, unsafe wrapper, copied invocation, or prompt-injected instruction can direct the credential to an attacker-controlled server. The code also does not explicitly prohibit plaintext HTTP, which could expose the key to network interception if an HTTP base URL is supplied. ### Attack Path 1. An attacker ...[truncated 959 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `--base-url` option from production use and hardcode the trusted API origin. 2. If an override is required for controlled testing, place it behind an explicit development-only mode that cannot receive real credentials. 3. Parse the destination and require: - Scheme: exactly `https` - Hostname: exactly `api.mew.design` - No embedded username or password - No unexpected port 4. Reject redirects or verify every redirect target before forwarding credential-bearing headers. 5. Do not send authentication headers across origin changes. 6. Add tests confirming that HTTP URLs, subdomain tricks, user-information URLs, alternate ports, and attacker-controlled hosts are rejected. 7. Combine this hardening with protected credential input so the key is exposed neither locally nor over an untrusted network route. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose suggests a simple conversation-to-image skill, but the actual behavior includes collecting and validating a third-party API key, probing authentication behavior, and sending user content to an external service. This mismatch undermines informed consent and can trick users into exposing credentials or conversation data under a less sensitive description.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Compression Heuristics

- Merge repeated requests into one clear statement.
- Collapse implementation detail into one bullet unless the detail affects outcome.
- Keep at most one metric per bullet unless comparisons matter.
- Convert long prose into noun-verb phrases.

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill invokes shell commands, writes temporary files, and makes network requests but does not declare any tool scope or permissions. That creates a hidden capability gap where an installer or user may believe the skill is limited to summarization while it can actually exfiltrate data and handle secrets through undeclared channels.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The installation triggers are broad enough to match common user requests such as asking for help installing a skill, which can cause the agent to initiate installation unexpectedly. Overbroad activation increases the chance of unreviewed execution of a skill that handles secrets and transmits data externally.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to collect the user's mew.design API key and pass it into shell commands and HTTP headers without a clear warning about secret handling, storage, or exposure risks. API keys are sensitive credentials, and prompting for them casually inside chat increases the risk of disclosure, logging, reuse, or mishandling.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill summarizes conversation content and sends it to an external image-generation API, but it does not clearly warn the user that chat content will leave the local environment. Conversations can contain confidential business, personal, or regulated data, so undisclosed external transmission is a material privacy and security risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The instructions require the agent to use the "exact onboarding copy" and the style-selection format entirely in Chinese, regardless of the user's language preference. This is a natural-language policy issue because it imposes a specific locale without opt-in or justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

Then generate the image through the official Mew design API:

```bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json

• Confidence: 97% confidence
• Finding: The hardcoded use of the api.mew.design endpoint confirms dependency on a third-party service for processing user-derived data and credentials. Even if this is functionally required, it is security-relevant because it expands the trust boundary beyond the local agent and can expose confidential material.

External Transmission

Medium

• Category: Data Exfiltration

Content

Then generate the image through the official Mew design API:

```bash
curl -sS -X POST "https://api.mew.design/open/api/design/generate" \
  -H "Content-Type: application/json" \
  -H "x-api-key: USER_PROVIDED_KEY" \
  --data @/tmp/chat-summary-body.json

• Confidence: 97% confidence
• Finding: The hardcoded use of the api.mew.design endpoint confirms dependency on a third-party service for processing user-derived data and credentials. Even if this is functionally required, it is security-relevant because it expands the trust boundary beyond the local agent and can expose confidential material.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This instruction says to create the image in Chinese unless the input is clearly another language, which imposes a language choice by default rather than letting the user choose. The policy for this audit flags language or locale constraints when they are forced without explicit opt-in or documented justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

import urllib.parse
import urllib.request

DEFAULT_BASE_URL = "https://api.mew.design/"


def parse_args() -> argparse.Namespace:

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:172