网瘾中年公众号封面设计

• Outcome: Review
• Latest audit: Jul 26, 2026 · 9:05 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed cover-prompt workflow, but it also includes an optional image-generation script that reads local API credentials, uploads prompts and reference images to Volcengine ARK, and writes output files despite repeated prompt-only framing.

Install only if you are comfortable with the optional direct-generation feature. Use the prompt-only workflow by default, and run gen_cover_volc.py only after confirming which prompt and reference images will be sent to Volcengine ARK and which API key from ~/.baoyu-skills/.env will be used. Avoid passing sensitive screenshots or private images as --ref unless third-party processing is acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares itself as a prompt-generation workflow, but the content instructs the agent to read local files and invoke a remote image-generation service. Undeclared file and network capabilities are dangerous because users and policy layers cannot accurately assess what data may be accessed or exfiltrated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented behavior materially exceeds the stated purpose: beyond generating prompts, it reads API secrets from a local .env file, uploads local reference images to a third-party service, and saves generated outputs to disk. This mismatch undermines informed consent and can lead to unintended credential use, data disclosure, and local side effects.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This section adds direct image-generation and file-writing behavior even though the skill presents itself elsewhere as producing prompts only. That creates a security and trust gap: users may provide sensitive local images or operate in an environment with credentials loaded, not realizing the skill can transmit data externally and persist outputs locally.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill introduces credential-dependent external API use unrelated to the minimal need of generating text prompts. Reading API keys from the user's home directory and sending prompt/reference data to a remote provider expands the attack surface and can expose private images, article content, or operational metadata.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill persists configuration to a local file even though it is framed primarily as a prompt generator. Persistent local state can surprise users, create privacy issues about retained preferences or paths, and broaden the skill's effective write capability beyond what is implied by the description.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill metadata says it generates cover prompts, but this script actually invokes a third-party image-generation API and downloads generated images. That capability expansion materially changes the trust boundary by introducing outbound network activity, third-party data processing, and local file writes beyond what a user would reasonably expect from a prompt-generation skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script reads API credentials from a local .env file and uses them to contact an external service, even though the advertised purpose is prompt generation. Accessing local secrets and performing network calls increases the capability surface and can surprise users who did not intend to grant credential use to this skill.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Reference images are read from local paths, base64-encoded, and uploaded to the external model service. This is a data exfiltration capability that is not clearly disclosed in the skill description, and users may inadvertently send sensitive local images to a third party.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script sends user prompts and optional reference images to a remote API without any explicit runtime warning or consent flow. In a skill presented as a prompt generator, this silent transmission can expose proprietary text, sensitive business information, or personal images to an external provider.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The script automatically reads credentials from ~/.baoyu-skills/.env without an explicit warning that local secrets will be accessed. While this is a common implementation pattern, it is still a transparency and least-surprise issue for a skill whose public description does not mention credential use.

Static analysis

No suspicious patterns detected.