Card Image Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.2

Overview

The skill is not clearly malicious, but it asks users to install and activate unpinned external components while making inconsistent claims about network and API-key use.

Review this before installing in a trusted workspace. Use a sandboxed directory, pin and verify any external skill or Python dependencies, avoid giving it sensitive input or credentials until the network/API model is clarified, and require explicit approval before gateway restart, recursive processing, or broad file writes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:206

Finding

Unpinned External Components Are Installed and Activated Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 206–207, 215, and 269–270
Vulnerability Type: Supply-chain exposure through unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

# SKILL.md:206-207
skill-platform skills install card-image-builder-pro
skill-platform gateway restart

bash

# SKILL.md:215
skill-platform skills install card-image-builder-pro

markdown

<!-- SKILL.md:269-270 -->
| Pillow | Python library | Recommended | `pip install Pillow` |
| Jinja2 | Python library | Optional | `pip install jinja2` (template rendering) |

Technical Analysis

The instructions install external components without specifying immutable versions, package hashes, signatures, or a verified source registry. The audited project contains only SKILL.md; it does not include the implementation of card-image-builder-pro or the Python scripts referenced elsewhere in the document.

Running skill-platform skills install card-image-builder-pro therefore retrieves and installs code outside the audited artifact. Because no version or digest is pinned, the content installed in the future may differ from the content that existed when this document was reviewed. The subsequent gateway restart may load and activate that unaudited component.

The suggested pip install Pillow and pip install jinja2 commands similarly allow the package resolver to select mutable releases and transitive dependencies without hash verification. This creates exposure to registry compromise, dependency-resolution changes, malicious replacement releases, and package-source misconfiguration.

No evidence establishes that the currently named packages are malicious. The vulnerability is the absence of controls ensuring that the installed code is the intended, reviewed code.

Attack Path

1. An attacker compromises or influences a configured package registry, package release, distribution channel, ...[truncated 1537 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin card-image-builder-pro to an immutable, reviewed version and, where supported, a cryptographic digest.
2. Explicitly identify and restrict installation to a trusted registry or repository.
3. Verify package signatures or published checksums before installation and activation.
4. Include the actual skill implementation in the audited artifact when feasible so its behavior can be reviewed directly.
5. Replace unconstrained pip install instructions with a locked dependency file containing exact versions and hashes, such as:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

6. Pin transitive dependencies through a reproducible lock file and regularly review updates before changing the lock.
7. Require explicit user confirmation before restarting the gateway or activating newly installed code.
8. Install and execute the skill using a least-privileged account in a sandbox with restricted filesystem, credential, and network access.
9. Document provenance information for every external component, including its source, version, digest, and review date.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation guidance is broad enough to match generic design, image, poster, and brand-visual tasks, increasing the chance that the agent invokes this skill in situations the user did not specifically request. Because the skill has exec, read, and write capabilities, overbroad routing materially raises the risk of unintended command execution or file modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill advertises batch generation and recursive directory processing with file output, but it does not prominently warn about filesystem scope, overwrite behavior, or resource impact. In practice, this could lead to unintended traversal, mass file creation, or writes into sensitive or unexpected locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown includes install, restart, and command-execution steps without a strong safety gate or warning. This is risky because users or agents may execute environment-changing commands directly from documentation, potentially installing untrusted components, restarting services, or running scripts without validating provenance or arguments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation makes mutually inconsistent trust claims about whether the skill is purely local or may use external services. This is dangerous because operators may approve or run the skill under a false assumption that no data leaves the host, when other sections imply network/API usage and possible remote dependencies.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims it does not involve network requests, but later says some functions require network connectivity. In a security review context, that inconsistency can cause unsafe deployment decisions, especially in restricted or sensitive environments where network isolation is assumed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Earlier text states no extra API key is needed, but the help section later says some features require API keys. This can mislead users into exposing credentials ad hoc or enabling external integrations they did not expect, undermining trust and safe configuration management.

Content

No source excerpt is available for this finding.