androidiconmaker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:46 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local Android icon generator, with dependency-installation guidance that users should handle cautiously.

Before installing, use a dedicated Python virtual environment and avoid --break-system-packages. Confirm the output directory, especially when writing into an existing Android project, because generated icon filenames may replace existing assets in that directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:46

Finding

Unpinned Pillow Installation with System Package Protection Bypass

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:46-53; also documented in README.md:28-32
Vulnerability Type: Unpinned third-party dependency and unsafe global installation guidance
Risk Level: Low

Vulnerable Code Snippets

SKILL.md:46-53:

bash

# Check whether Pillow is installed
python3 -c "from PIL import Image; print('Pillow installed')"

# Install on Linux/macOS/Windows
pip install pillow

# If a permission error occurs, add --break-system-packages (Linux)
pip install pillow --break-system-packages

README.md:28-32:

bash

pip install pillow
# On Linux, if an error occurs, add:
pip install pillow --break-system-packages

Technical Analysis

The installation instructions resolve pillow without a fixed version or integrity hash. Consequently, the installed artifact depends on the package index and package version available at installation time rather than an audited, reproducible dependency set.

If an upstream release, configured package index, mirror, or package-distribution account is compromised, following these instructions could install attacker-controlled package code. Python packages can execute build or installation logic during installation, and malicious package content can subsequently execute whenever the skill imports PIL.

The suggested --break-system-packages option bypasses protections intended to prevent pip from modifying an externally managed Python environment. It does not independently grant elevated privileges, but when run by an account with permission to modify the target environment, it can overwrite or conflict with operating-system-managed Python packages and expand the effect beyond this project.

Attack Path

1. An attacker compromises a future Pillow distribution, a package-index account, or a package mirror configured in the operator's environment.
2. A user follows the documented pip install pillow instruction.
3. Bec ...[truncated 1331 chars]

Remediation

View remediation

Remediation Suggestions

1. Declare Pillow in a dependency or lock file using an exact, reviewed version.
2. Use hash verification, for example through a requirements file containing Pillow==<reviewed-version> and hashes generated by pip-compile --generate-hashes, then install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Install dependencies inside a dedicated virtual environment:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   python3 -m pip install --require-hashes -r requirements.txt
   

4. Remove the recommendation to use --break-system-packages. Explain that an externally managed environment should be handled with a virtual environment rather than by overriding package-manager safeguards.
5. Document the expected package index and advise against untrusted mirrors or unexpected PIP_INDEX_URL configurations.
6. Periodically review and update the pinned Pillow version for published security fixes, regenerating and reviewing hashes with each update.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger list includes broad, natural-language phrases such as '做个图标吧' and 'make this an app icon' that may match casual conversation beyond a clearly scoped tool invocation. This can cause unintended activation on user images, leading to unrequested file processing or downstream actions based on the wrong context.

Content

No source excerpt is available for this finding.