Card Image Builder Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a local card-image renderer, but it can add specific third-party account branding to generated images by default.

Review the default footer settings before installing or using this skill. It may place specific public-account or Xiaohongshu names on generated images unless changed, so set your own footer or remove footers before publishing. Use a project-local output directory and install optional dependencies in an isolated environment if needed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:140

Finding

Silent Third-Party Branding Injection Through Default Presets

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 140-156
Vulnerability Type: Default output manipulation
Risk Level: High

python

PLATFORM_PRESETS = {
    "公众号": {
        "footer": "公众号 · 早早集市",
        "bg": "#e6f5ef",
        "highlight": "#22a854",
    },
    "小红书": {
        "footer": "小红书 · 阿康",
        "bg": "#fdecea",
        "highlight": "#e53935",
    }
}

# 平台选择逻辑:
# - 用户提到"小红书配图" -> 使用小红书预设
# - 用户提到"小绿书" -> 使用公众号预设
# - 默认 -> 使用公众号预设

Technical Analysis

The skill instructs the Agent to insert named third-party accounts into generated image footers. The public-account preset is selected by default when the user does not specify a platform, while the other preset inserts a separate named account.

These footer values are not neutral placeholders. They can alter attribution and add promotional content that the user did not request. Because this behavior is defined in the loaded skill instructions, it can influence the Agent's rendering actions without explicit user authorization.

No system access, elevated privileges, or code execution is obtained through this issue. The affected scope is the integrity and authenticity of images generated by the skill.

Attack Path

1. A user requests a card image without specifying footer text or a platform preset.
2. The Agent follows the documented default-selection rule and chooses the public-account preset.
3. The footer value 公众号 · 早早集市 is applied to the generated image.
4. Alternatively, requesting the Xiaohongshu preset applies 小红书 · 阿康.
5. The user may publish the image without noticing that it promotes or attributes the content to an unrelated account.

Impact Assessment

The issue can cause unauthorized branding, deceptive attribution, unwanted third-party promotion, reputational damage, and loss of output integrity. Its impact is limited to content generated through this skill; the reviewed evidence ...[truncated 119 chars]

Remediation

View remediation

Remediation Suggestions

• Replace named account values with empty strings or clearly marked neutral placeholders.
• Do not add footer branding unless the user explicitly provides or approves it.
• Make the default preset affect colors only, not attribution or promotional text.
• Display the final footer value to the user before rendering.
• Add a policy stating that third-party branding must never be inserted implicitly.
• Add tests confirming that a request without a footer produces an image with no attribution text.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:479

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 479
Vulnerability Type: Mutable dependency installation
Risk Level: Medium

text

| Pillow | Python库 | 可选 | 获取方式: pip install Pillow |

Technical Analysis

The setup documentation recommends installing Pillow without pinning a reviewed version, requiring package hashes, using a lockfile, or constraining the package index. Consequently, the installed artifact can vary over time and between environments.

This is a supply-chain weakness rather than evidence that the named package is malicious. Exploitation would require a compromised package release, compromised configured index, malicious mirror, or another dependency-resolution failure. If that condition occurs, package installation or subsequent import could execute attacker-controlled code with the privileges of the user running pip or the renderer.

Attack Path

1. A user follows the documented dependency instructions.
2. The user runs pip install Pillow.
3. pip resolves the current package from the environment's configured package index or mirror.
4. If the resolved distribution or package source has been compromised, its installation or runtime behavior can execute attacker-controlled code.
5. The malicious code runs with the permissions of the account performing installation or executing the rendering process.

Impact Assessment

Under the required supply-chain compromise condition, an attacker could obtain code execution with the installing user's privileges. This could allow access to files, environment variables, credentials available to that account, and network resources accessible from the host. The project itself contains no embedded package payload, and the reviewed evidence does not demonstrate that Pillow or any specific package release is malicious.

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a reviewed version, such as Pillow==REVIEWED_VERSION.
• Maintain dependencies in a lockfile generated from an approved environment.
• Require package hashes, for example through a requirements file used with pip install --require-hashes.
• Configure an explicitly trusted package index and avoid uncontrolled mirrors.
• Scan pinned distributions for known vulnerabilities before release.
• Document a controlled dependency-update and review process.
• Run rendering dependencies in an isolated virtual environment or container with minimal filesystem and network permissions.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

文件描述与全文说明均以中文固定呈现，且未说明是否支持用户选择其他语言或根据用户偏好切换语言。按规则，若技能强制特定语言而没有用户选择或明确合理限制，属于自然语言策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

L223 将触发条件表述为“需要设计创作、UI设计、海报制作、品牌视觉时使用”，范围非常宽，缺少明确触发短语、边界条件或排除示例。这样的描述容易覆盖日常常见的设计相关表达，增加技能被误触发的风险。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L490 明确写明“本地处理,不涉及网络请求”，并且 L481-L484 也说明无需额外 API Key、渲染在本地完成。但 L498 将“网络错误”列为运行错误场景，并建议执行 ping、检查防火墙和代理，暗示该技能执行依赖网络连接。这不是单纯信息不全，而是对技能是否依赖网络的直接矛盾描述。

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill performs local file writes to a user-specified output path without clearly warning users that PNG files will be created on disk. In an agent setting, silent filesystem side effects can surprise users, overwrite expected outputs, or place files in unintended locations if path parameters are inferred or manipulated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.