画板艺术工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:36 AM UTC
• Version: 1.0.3

Overview

This skill appears to be a pixel-art board helper, but it asks for command/write authority while shipping no reviewed implementation and documenting ambiguous shell commands.

Review before installing. Only use this if you can constrain execution to trusted, bundled scripts or a scoped platform API. Do not run the documented sh view, sh locate, or sh export examples from an untrusted workspace, and avoid granting write or broad shell access unless the missing implementation is supplied and reviewed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:89

Finding

Ambiguous Shell Commands Can Execute Attacker-Controlled Working-Directory Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:89-92, SKILL.md:189, and SKILL.md:208
Vulnerability Type: Ambiguous local script execution
Risk Level: Medium

Vulnerable Code

bash

# View the canvas overview
sh view --board main

# Locate my artwork
sh locate --board main --mine

Additional affected commands:

bash

sh view --board main --region 100,100,200,200

bash

# Export my artwork backup
sh export --mine --out my-artworks.tar.gz

Technical Analysis

The commands pass the generic filenames view, locate, and export directly to the shell interpreter. These are not canonical paths to trusted scripts, and the audited package does not contain files implementing these commands.

When an Agent executes a command such as sh view --board main, sh interprets the file named view from the command's working directory. Consequently, command behavior depends on which files happen to exist in that directory rather than on a reviewed implementation distributed with the Skill.

This creates a local arbitrary-command execution opportunity when an attacker can place a malicious file named view, locate, or export in a directory from which the Agent runs the documented command. The absence of an integrity check, trusted absolute path, or bundled implementation prevents the Agent from establishing that it is executing legitimate canvas functionality.

Attack Path

1. An attacker gains the ability to add a file to the Agent's project or working directory, such as through a malicious repository, untrusted archive, shared workspace, or previously generated file.
2. The attacker creates a shell script named view, locate, or export.
3. A user asks the Agent to perform the corresponding operation documented by the Skill.
4. The Agent follows SKILL.md and executes a command such as sh view --board main.
5. The shell interprets the attacker-controlled file.
6. Commands in that file execute with the operating- ...[truncated 616 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle reviewed implementation scripts inside the Skill package rather than referring to generic working-directory filenames.

2. Invoke every script through a trusted canonical path, for example:

   bash

   sh "${baseDir}/scripts/view.sh" --board main
   sh "${baseDir}/scripts/locate.sh" --board main --mine
   sh "${baseDir}/scripts/export.sh" --mine --out "my-artworks.tar.gz"
   

3. Validate that the resolved script remains inside the expected Skill directory before execution.

4. Verify packaged script integrity and ownership where the hosting platform supports those controls.

5. Quote all paths and user-supplied arguments.

6. Validate board names, coordinates, region values, and output paths against strict allowlists or schemas.

7. Do not fall back to similarly named files in the current directory or search path when the expected implementation is missing.

8. Fail safely with an explicit error if the trusted script is unavailable.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:5

Finding

Execution and Filesystem-Write Permissions Are Declared Without a Corresponding Implementation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:5, SKILL.md:18-21, and SKILL.md:68-71
Vulnerability Type: Excessive and inconsistent tool permissions
Risk Level: Low

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

The documented implementation path is:

bash

# Publish artwork to the canvas (free version)
{baseDir}/scripts/board.sh publish \
  --board main \
  --x 100 --y 200 \
  --art ./my-art.json

Technical Analysis

The Skill declares unrestricted command-execution capability through exec and filesystem modification capability through write, even though the audited package contains only SKILL.md. The referenced scripts/board.sh implementation is absent.

The permission declarations are also inconsistent: the top-level allowed-tools field permits read and exec, while the separate tools list additionally requests write. This ambiguity can cause different Agent platforms to grant different effective capabilities.

Because there is no implementation requiring or constraining these capabilities, the declarations violate least-privilege principles. An Agent may grant shell execution or filesystem-write access to a documentation-only Skill that cannot carry out its stated operation through reviewed code. If the Agent attempts to improvise after discovering that the referenced script is missing, the broad permissions increase the potential effect of unsafe instructions or untrusted workspace content.

Attack Path

1. The Skill is installed or activated, and the hosting Agent interprets one or both tool-permission declarations.
2. The Agent grants exec, and potentially write, to the Skill.
3. A user requests a publish, view, locate, or export operation.
4. The referenced implementation is unavailable because scripts/board.sh and the other implied scripts are not included in the package.
5. The Agent may attempt to construct replacement shell commands, ...[truncated 845 chars]

Remediation

View remediation

Remediation Suggestions

1. Add and independently audit the implementation scripts before requesting execution permission.
2. Remove exec and write if the Skill remains documentation-only.
3. Make all tool declarations consistent so that every supported Agent platform applies the same permission boundary.
4. Request only the capabilities needed for each operation. For example, read-only canvas viewing should not receive filesystem-write access.
5. Prefer narrowly scoped platform APIs over unrestricted shell execution.
6. If file output is required, restrict writes to an explicit output directory and prevent path traversal or overwrite of existing sensitive files.
7. Configure the Skill to stop with a clear error when a required bundled implementation is absent; the Agent must not improvise replacement shell commands.
8. Document the exact network endpoint, authentication mechanism, accepted inputs, and expected outputs so implementations can be reviewed and constrained.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description contains broad language like efficiency improvement, automation, batch processing, and workflow optimization, which overlaps with many benign user requests and can cause this exec-capable skill to be selected far outside its intended domain. In agent environments, overly generic routing text is dangerous because it can turn a specialized tool into a broadly auto-invoked command surface.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger description is overly broad and unrelated to the actual function of the skill, increasing the chance that an agent will invoke a tool-enabled skill during general productivity or collaboration tasks. Because the skill declares exec/write capability, unintended activation expands the attack surface and may lead to unnecessary command execution or actions in the wrong workflow context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest states '支持中文交互' as a capability, and the document consistently presents the skill as Chinese-only without mentioning user choice or opt-in for locale. This can violate language/locale policy when the skill is used in environments where users have not chosen Chinese.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The '触发条件' section says to use the skill for '项目管理、任务规划、进度跟踪、团队协作', but the rest of the file defines a pixel-art board publishing tool. This is not merely incomplete documentation; it directs use for a materially different purpose than the implemented skill intent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The FAQ states '不能。批量发布多作品吗？A：不能。批量发布与画布治理为专业版能力', while the top-level description says the skill is for '批量处理'. These statements directly conflict about whether batch processing is part of this skill's intended capability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.