花叔Design

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:12 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent design and media toolkit, but it needs review because some optional scripts and default workflows create real security and privacy risks.

Review before installing. Use this skill only in projects where you are comfortable with web asset retrieval and local media tooling. Do not run the narration/export scripts on untrusted filenames, timeline JSON, or output paths until the shell and node -e injection issues are fixed. Avoid placing sensitive personal data in the suggested agent memory asset index unless you explicitly want the agent to use it, and verify animation exports for unwanted Huashu-Design watermarking. If using TTS, keep credentials outside the skill directory where possible and do not set custom TTS endpoints unless they are trusted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:781

Finding

Mandatory Promotional Branding Injected into User Deliverables

Content

View full analysis

Created by Huashu-Design ``` ### Technical Analysis The Skill instructs the Agent to add promotional branding to animation deliverables by default. This branding is not required to create, render, or export an animation and changes the user's requested output for the benefit of the Skill author. The opt-out provision does not eliminate the issue because users who do not know about the instruction may receive branded deliverables without informed consent. This is a form of instruction-level goal manipulation: after loading the Skill, the Agent is directed to pursue Skill promotion in addition to the user's design objective. ### Attack Path 1. A user installs or loads the Skill. 2. The user asks the Agent to create or export an animation. 3. The Agent follows the mandatory default instruction in `SKILL.md`. 4. The Agent embeds `Created by Huashu-Design` in the HTML, MP4, or GIF. 5. The user may publish or distribute the altered deliverable without realizing that third-party promotional branding was inserted. ### Impact Assessment The issue does not grant operating-system privileges, but it affects the integrity and ownership of generated deliverables. Consequences can include: - Unauthorized third-party branding in custo ...[truncated 215 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/narrate-pipeline.mjs:145

Finding

Shell Command Injection Through Narration Output Paths

Content

View full analysis

`file '${p.replace(/'/g, "'\\''")}'`).join('\n'), ); execSync( `ffmpeg -y -f concat -safe 0 -i "${listFile}" -c copy "${output}"`, { stdio: ['ignore', 'pipe', 'pipe'] }, ); fs.unlinkSync(listFile); } function makeSilence(duration, outPath) { execSync( `ffmpeg -y -f lavfi -i anullsrc=r=24000:cl=mono -t ${duration} -q:a 9 -acodec libmp3lame "${outPath}"`, { stdio: ['ignore', 'pipe', 'pipe'] }, ); } ``` The affected values originate from caller-controlled output arguments: ```js const outDir = path.resolve(args.outDir); const audioDir = path.join(outDir, 'audio'); const tmpDir = path.join(outDir, '.tmp'); const gapFile = path.join(tmpDir, 'gap.mp3'); if (gap > 0) makeSilence(gap, gapFile); const voiceoverPath = path.join(outDir, 'voiceover.mp3'); ffmpegConcat(sceneAudioFiles, voiceoverPath); ``` ### Technical Analysis `execSync()` invokes a shell. The code constructs shell command strings by interpolating filesystem paths directly inside double quotes. Double quotes do not make arbitrary input safe when the input itself can contain a double quote, command substitution, backticks, or other shell metacharacters. The `--out-dir` argument is resolved as a path but is not restricted to safe characters. Path normalization does not perform shell escaping. A crafted output directory can therefore terminate the quoted argument and append another shell command. The `gap` value is converted with `parseFloat()`, reducing direct string injection through that field, but it is not checked with `Number.isFinite()` or constrained to a sensible range. The path inte ...[truncated 1214 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render-narration.sh:72

Finding

Arbitrary Node.js Code Injection Through Timeline Path and JSON Content

Content

View full analysis

&2 exit 1 fi # Recording duration = total duration + 1-second safety buffer RECORD_DURATION=$(node -e "console.log(Math.ceil($TOTAL_DURATION + 1))") ``` ### Technical Analysis The script inserts `$TIMELINE` directly into JavaScript source passed to `node -e`. Although shell expansion occurs inside a double-quoted shell string, the expanded filename is placed inside a single-quoted JavaScript string literal. A timeline filename containing a single quote can terminate that JavaScript string and inject arbitrary Node.js statements. A second injection sink exists through `TOTAL_DURATION`. The value is read from attacker-controlled JSON and then inserted directly into a new `node -e` program: ```bash node -e "console.log(Math.ceil($TOTAL_DURATION + 1))" ``` JSON does not require `totalDuration` to be numeric. If it is a string containing a valid JavaScript expression, the resulting text becomes executable source in the second Node.js invocation. Merely checking that the timeline file exists does not establish that either the path or its contents are safe. ### Attack Path #### Path-based exploitation 1. An attacker creates or supplies a timeline file whose filename contains a single quote and additional JavaScript syntax. 2. The file passes the `-f "$TIMEL ...[truncated 1319 chars]

Remediation

View remediation

86400) { throw new Error("Invalid totalDuration"); } if (typeof timeline.voiceover !== "string" || timeline.voiceover.includes("\0")) { throw new Error("Invalid voiceover path"); } process.stdout.write( JSON.stringify({ totalDuration: timeline.totalDuration, voiceover: timeline.voiceover }) ); ' "$TIMELINE") ``` 3. Prefer a dedicated Node.js helper script over repeated `node -e` invocations. 4. Validate that `totalDuration` is a finite number within an expected range. 5. Validate that `voiceover` is a relative path and reject traversal outside `TIMELINE_DIR`. 6. Compute `RECORD_DURATION` in the same trusted parser invocation rather than constructing a second program. 7. Add tests for apostrophes and other metacharacters in filenames and for nonnumeric `totalDuration` values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tts-doubao.mjs:95

Finding

API Key and Narration Exfiltration Through an Unrestricted TTS Endpoint Override

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:457

Finding

Automatic Access to Private Agent Memory for Personal Asset Discovery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: assets/showcases/website-ai-nav/ainav-build.html:9

Finding

Execution of Mutable Third-Party JavaScript from an Unpinned CDN Dependency

Content

View full analysis

``` For example, `assets/showcases/website-ai-nav/ainav-build.html` contains: ```html ``` ### Technical Analysis The `@latest` selector is mutable and can resolve to different JavaScript after the Skill has been reviewed. No Subresource Integrity hash is present, so the browser cannot verify that the retrieved script matches an audited version. Opening a bundled showcase therefore grants executable browser-context access to code controlled by the package publisher and CDN at runtime. This creates a remote payload channel whose effec ...[truncated 1418 chars]

Remediation

View remediation

``` 3. Prefer vendoring the audited library inside the project so showcases work offline. 4. Apply a restrictive Content Security Policy that permits scripts only from approved local files or exact trusted origins. 5. Use automated dependency-update tooling to review and deliberately update the pinned version. 6. Add a repository check that rejects `@latest`, unversioned CDN scripts, and executable remote resources without integrity metadata. 7. Apply the correction consistently to every affected showcase file. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (185)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The description advertises an expansive end-user design skill: creating high-fidelity prototypes, interactive demos, animations, design variants, style recommendations, expert critiques, Playwright click-testing, and media export workflows. The supplied code does not implement those broad behaviors. Instead, it is a specialized converter/validator that parses an HTML slide, extracts layout/style information, and recreates it in a PowerPoint slide. Its use of Playwright is only to render and inspect HTML for conversion, not to test app prototypes as described. There is no evidence here of design consulting, generation of variants, review scoring, animation production, narration/TTS, or MP4/GIF export. The code’s primary purpose is materially different and significantly narrower than the declared purpose, so this is a mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 610)May include surrounding context.

md

- **必做**：每页独立 HTML + `assets/deck_index.html` 聚合（重命名为 `index.html`，编辑 MANIFEST 列所有页），浏览器里键盘翻页、全屏演讲——这是幻灯片作品的"源"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 706)May include surrounding context.

md

- **必做**：每页独立 HTML + `assets/deck_index.html` 聚合（重命名为 `index.html`，编辑 MANIFEST 列所有页），浏览器里键盘翻页、全屏演讲——这是幻灯片作品的"源"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 717)May include surrounding context.

md

- **必做**：每页独立 HTML + `assets/deck_index.html` 聚合（重命名为 `index.html`，编辑 MANIFEST 列所有页），浏览器里键盘翻页、全屏演讲——这是幻灯片作品的"源"

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 611)May include surrounding context.

md

- **可选导出**：额外询问是否需要 PDF（`export_deck_pdf.mjs`）或可编辑 PPTX（`export_deck_pptx.mjs`）作为衍生物

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 719)May include surrounding context.

md

- **可选导出**：额外询问是否需要 PDF（`export_deck_pdf.mjs`）或可编辑 PPTX（`export_deck_pptx.mjs`）作为衍生物

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 611)May include surrounding context.

md

- **可选导出**：额外询问是否需要 PDF（`export_deck_pdf.mjs`）或可编辑 PPTX（`export_deck_pptx.mjs`）作为衍生物

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 721)May include surrounding context.

md

- **可选导出**：额外询问是否需要 PDF（`export_deck_pdf.mjs`）或可编辑 PPTX（`export_deck_pptx.mjs`）作为衍生物

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 722)May include surrounding context.

md

- **可选导出**：额外询问是否需要 PDF（`export_deck_pdf.mjs`）或可编辑 PPTX（`export_deck_pptx.mjs`）作为衍生物

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 707)May include surrounding context.

md

- **单文件**（≤10页 / pitch deck / 需跨页共享状态）→ `assets/deck_stage.js` web component

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 718)May include surrounding context.

md

- **单文件**（≤10页 / pitch deck / 需跨页共享状态）→ `assets/deck_stage.js` web component

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 741)May include surrounding context.

md

- **单文件**（≤10页 / pitch deck / 需跨页共享状态）→ `assets/deck_stage.js` web component

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 721)May include surrounding context.

md

| `scripts/export_deck_pptx.mjs` | **HTML→可编辑 PPTX 导出** · 调 `html2pptx.js` 导出原生可编辑文本框，文字在 PPT 里双击可直接编辑。**HTML 必须符合 4 条硬约束**（见 `references/editable-pptx.md`），视觉自

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 722)May include surrounding context.

md

| `scripts/export_deck_pptx.mjs` | **HTML→可编辑 PPTX 导出** · 调 `html2pptx.js` 导出原生可编辑文本框，文字在 PPT 里双击可直接编辑。**HTML 必须符合 4 条硬约束**（见 `references/editable-pptx.md`），视觉自

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 742)May include surrounding context.

md

| `scripts/export_deck_pptx.mjs` | **HTML→可编辑 PPTX 导出** · 调 `html2pptx.js` 导出原生可编辑文本框，文字在 PPT 里双击可直接编辑。**HTML 必须符合 4 条硬约束**（见 `references/editable-pptx.md`），视觉自

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 724)May include surrounding context.

md

| `animations.jsx` | 任何动画HTML | Stage + Sprite + useTime + Easing + interpolate |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 743)May include surrounding context.

md

| `animations.jsx` | 任何动画HTML | Stage + Sprite + useTime + Easing + interpolate |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 812)May include surrounding context.

md

| `animations.jsx` | 任何动画HTML | Stage + Sprite + useTime + Easing + interpolate |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 744)May include surrounding context.

md

| **动画的正向设计语法**（Anthropic 级叙事/运动/节奏/表达风格）| `references/animation-best-practices.md`（5 段叙事+Expo easing+运动语言 8 条+3 种场景配方）|

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 7)May include surrounding context.

text

@import url('https://fonts.googleapis.com/css2?family=Inter:wght@400;500;700;900&family=Noto+Serif+SC:wght@700;900&display=swap');
    </style>

    <!-- Warm accent gradients for mini mockup highlights -->
    <linearGradient id="hdBarGrad" x1="0" y1="0" x2="0" y2="1">
      <stop offset="0%" stop-color="#D4532B"/>
      <stop offset="100%" stop-color="#A83518"/>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 59)May include surrounding context.

text

letter-spacing="-3"
  >Huashu Design</text>

  <!-- Chinese subtitle -->
  <text
    x="80"
    y="222"

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/banner.svg (reported line 100)May include surrounding context.

text

letter-spacing="0.3"
  >20 种设计哲学  ·  5 维专家评审  ·  发布会级动画导出</text>

  <!-- Footer credit -->
  <text
    x="80"
    y="370"

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/deck_index.html (reported line 6)May include surrounding context.

html

<head>
<meta charset="UTF-8">
<title>Deck · Multi-file Slide Index</title>
<!--
  deck_index.html — 多文件 slide deck 的拼接器

  配合「每页一个独立 HTML」架构使用。与单文件 deck_stage.js 对比：

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/deck_index.html (reported line 6)May include surrounding context.

html

<head>
<meta charset="UTF-8">
<title>Deck · Multi-file Slide Index</title>
<!--
  deck_index.html — 多文件 slide deck 的拼接器

  配合「每页一个独立 HTML」架构使用。与单文件 deck_stage.js 对比:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/showcases/infographic/infographic-build.html (reported line 359)May include surrounding context.

html

<body>
<div class="container">

  <!-- Label -->
  <div class="label">System Architecture</div>

  <!-- Title -->