Security audit

Card Image Builder

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly describes local card-image generation, but its broad execution/write authority is paired with inconsistent network, API-key, and batch-processing guidance that users should review before installing.

Install only if you are comfortable with a skill that can guide an agent to read files, run local Python/Chrome commands, and write generated outputs. Use a dedicated workspace, explicitly set input and output paths, avoid recursive runs over private directories, and do not provide API keys until the publisher documents which feature needs them and what data is sent externally.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documentation gives conflicting statements about whether the skill uses network or API capabilities, which can cause users or an agent to apply the wrong trust and sandboxing assumptions. In a skill that exposes read/exec/write tools, ambiguity about network use increases the risk of unintended data egress or unsafe execution under weaker controls.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill claims it does not make network requests, yet other sections describe network-dependent behavior and mention API usage. This contradiction can mislead operators into running the skill with broader file and execution privileges while assuming no exfiltration path exists, which is dangerous for a locally executed agent skill.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The Q&A states that API keys are needed, directly conflicting with the earlier claim that no API key is required. Security-relevant inconsistencies like this undermine safe deployment decisions and may cause users to provision secrets unnecessarily or trust the skill's privacy properties incorrectly.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The activation text is overly broad, encouraging use whenever users need design or creative work rather than narrowly scoping when this skill should run. Broad triggering increases the chance an agent will invoke a skill with exec/read/write capabilities in irrelevant contexts, expanding attack surface and causing unintended file operations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The description advertises recursive directory processing and batch generation without a clear warning that these actions can traverse and modify many files. In a skill with write and exec permissions, that omission can lead users or agents to run destructive or privacy-impacting operations over unintended paths.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill documents command execution examples but does not provide a strong warning about the security risks and prerequisites of executing local commands. Because the skill declares exec capability, insufficient warning can normalize unsafe execution and lead to misuse, dependency abuse, or unexpected system changes.

Static analysis

No suspicious patterns detected.