T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:16- Finding
Unnecessary Filesystem and Command-Execution Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Art Creator Free
Security checks for vulnerabilities and agentic risk
Overview
This art-guidance skill contains no embedded malicious payload, but it asks for broad read/write/command permissions and broad activation scope that do not fit its stated purpose.
Install only if you are comfortable reviewing it under the Review bucket. Its art advice content is coherent, but the metadata should be narrowed before routine use: remove write and exec, keep only one tools field, limit activation wording to art creation and critique, and clarify whether callback_url can ever transmit results externally.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest presents the skill as an art-creation assistant but also advertises broad use for AI model invocation, agent orchestration, and LLM applications. That mismatch can cause the skill to be selected in unrelated contexts where its declared tools, including exec, become available more widely than justified by its stated purpose.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The broad invocation wording makes the skill eligible in many unrelated AI and agent scenarios, increasing the chance it is auto-selected where its permissions are unnecessary. Over-broad triggering is dangerous because it expands exposure of read/write/exec capabilities beyond the narrow art-guidance context users would reasonably expect.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Declaring exec for an art-guidance skill is excessive, and the document further normalizes command-line and network diagnostics unrelated to the core function. In agent platforms, unnecessary exec materially increases the attack surface by enabling shell access patterns that could be abused through prompt injection, user confusion, or unsafe operator assumptions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill both claims that data is not uploaded and defines a callback_url input while later referencing network troubleshooting, without clear warning that outputs may be transmitted externally. This ambiguity can undermine user consent and platform policy controls around outbound data handling.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The capability coverage section lists overly broad, fragmented keywords that can act as catch-all activation cues across unrelated contexts. In systems that route or recommend skills by keyword matching, this can cause unexpected invocation and unnecessary exposure of the skill's powerful tool permissions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill states that no data is uploaded, yet elsewhere it defines a callback URL and includes network troubleshooting guidance, creating a contradiction about external data flows. This can mislead users and hosts into exposing prompts, results, or metadata to remote endpoints without informed consent, especially in agent environments that may honor callback patterns automatically.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The copyright section states the skill was 'completely Chinese-localized' to fit Chinese creators' workflows, but the document does not offer users a language selection or opt-in. That can violate a language/locale policy where tools should not force a specific language unless clearly justified and user-selectable.
- Content