AI图像提示词-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.3

Overview

This image-prompt skill appears non-malicious, but it asks for command and file-write authority that does not fit its documented Markdown-only purpose.

Review before installing. The skill does not contain an observed malicious payload, exfiltration behavior, or persistence mechanism, but it should not need shell execution or file-writing authority for prompt drafting. Prefer a version with narrow image-prompt triggers, no exec/write permission, and clear disclosure for any prompt history or save/export behavior.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Excessive and Inconsistent Tool Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5 and SKILL.md:17-20
Vulnerability Type: Excessive tool privileges and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

Technical Analysis

The skill declares exec and write capabilities even though its documented function is to construct image-generation prompts from natural-language input. The document later identifies the skill as a pure Markdown workflow that does not require command-line execution.

The two permission declarations are also inconsistent: allowed-tools permits read and exec, while the separate tools list additionally requests write. Depending on how the hosting agent interprets overlapping metadata, the skill may receive arbitrary command-execution and filesystem-write capabilities that are unnecessary for its legitimate purpose.

The document also presents a command invoking scripts/build_prompt.py, but that script is absent from the audited project. Consequently, the command-execution workflow cannot be verified against local implementation. No malicious command, payload, persistence mechanism, or data-exfiltration behavior was found; the risk arises from unnecessary permissions and the possibility that later untrusted instructions could influence their use.

Attack Path

1. The agent loads the skill and grants the declared exec or write capability.
2. An attacker supplies crafted prompt content or other untrusted instructions intended to influence tool invocation.
3. The skill or agent incorrectly treats the supplied content as a command, command argument, file path, or file content.
4. The agent invokes exec or write under its own operating-system privileges.
5. The attacker may cause local command execution or modification of files accessible to the agent.

Successful exploitation requires ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and write from all tool declarations because prompt construction can be performed directly by the LLM.
2. Remove read as well unless the skill genuinely needs to load local template files.
3. Use a single authoritative tool-permission declaration to prevent inconsistent policy interpretation.
4. Remove the example invoking the nonexistent scripts/build_prompt.py, or add the script to the package and subject it to a separate security review.
5. If command execution is introduced later, enforce a fixed executable allowlist, pass arguments without shell interpolation, reject user-controlled command fragments, and run the process in a restricted sandbox.
6. If file output becomes necessary, restrict writes to a dedicated workspace directory, normalize and validate paths, reject traversal sequences and symbolic-link escapes, and avoid overwriting existing files by default.
7. Add automated package validation that rejects references to missing files and flags permissions not justified by documented functionality.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description contains an excessively broad usage condition covering general AI model calls, intelligent dialogue, agent orchestration, and LLM applications, which goes far beyond an image-prompt helper. In context, this is more dangerous because the skill also requests powerful tools, so broad routing language can cause a prompt-oriented skill to be selected in workflows where shell or file access should never have been exposed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill requests exec capability even though the documentation later claims it is a pure Markdown instruction skill that does not require command execution. Granting shell execution to a skill that should only transform text violates least privilege and creates unnecessary exposure to command execution, environment access, and filesystem interaction if the skill is invoked or extended unsafely.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is overly broad and mismatched to the skill’s image-prompt purpose, making accidental over-invocation likely in generic AI or content workflows. In agent systems, broad triggers are risky because they can silently expand the situations in which a more privileged or less appropriate skill is selected, including cases involving write or exec-enabled tools.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation says the skill is pure Markdown and does not need exec, yet it also instructs the user to run a Python script and the manifest grants exec. These contradictions make the real execution model unclear, which is dangerous because users and orchestrators may trust the low-risk Markdown description while the skill retains the ability to execute local commands.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill is presented as a simple image-prompt crafting tool, but the documentation expands its capabilities into generic create/query/modify/delete, import/export, and save operations without clear scope boundaries. In an agent ecosystem, this ambiguity can cause the skill to be invoked for broader data-handling workflows than intended, increasing the chance of unintended file operations, data retention, or misuse of write-enabled tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill describes save, export, import, modify, and delete operations but does not clearly warn users that prompt content may be persisted or moved across boundaries. Because prompts can contain proprietary concepts, personal data, or confidential campaign material, undisclosed retention or export behavior can create privacy and data-governance risks even if the content seems low sensitivity at first glance.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger conditions broaden this image-prompt skill into marketing copy, writing, title optimization, and general content creation, which materially exceeds the stated purpose. That scope drift can cause an orchestrating agent to route unrelated tasks through this skill, creating confused-deputy behavior and exposing users to outputs or side effects they did not expect from a prompt-only image tool.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The FAQ states that most image models understand English prompts more accurately and recommends using English descriptions or conversion to English. This nudges users toward a specific language without explicitly presenting it as an optional preference, which can conflict with language-choice policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.