Chart Craft Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:29 AM UTC
• Version: 1.0.0

Overview

This appears to be a local chart-generation skill, but its privacy and networking claims are internally inconsistent enough that users should review it before installing.

Before installing, treat the local-only privacy promise as incomplete: chart data may still be processed by the hosting agent/LLM, and the documented callback_url should not be used unless you explicitly intend network callbacks. Install matplotlib in a dedicated virtual environment and avoid sensitive datasets until the publisher clarifies the data-flow model and includes reviewable chart scripts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:206

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 206
Vulnerability Type: Unpinned dependency installation from the environment's default package index
Risk Level: Medium

Vulnerable Code

text

### Dependency details
Run `pip3 install matplotlib` to install it. If permissions are insufficient, use `pip3 install --user matplotlib` to install it in the user directory.

Technical Analysis

The Skill directs the user or AI Agent to install matplotlib without specifying an audited version, verifying package hashes, using a lock file, or requiring an isolated environment. Package resolution relies on the invoking environment's configured Python package index and resolves both matplotlib and its transitive dependencies dynamically.

Although matplotlib is a legitimate package name, the installation process is not reproducible or integrity-protected. A compromised package index, malicious index configuration, compromised upstream release, or compromised transitive dependency could introduce attacker-controlled code. Using --user avoids a system-wide installation but does not prevent package installation logic or subsequently imported package code from running with the user's privileges.

No evidence establishes that the current matplotlib package is malicious. The finding concerns the unsafe dependency acquisition practice documented by the Skill.

Attack Path

1. A user or AI Agent follows the dependency setup instruction in SKILL.md.
2. pip3 contacts the package indexes configured in the execution environment.
3. Because no version or hashes are specified, pip accepts the version and transitive dependencies selected at installation time.
4. A compromised index, release, or transitive dependency provides attacker-controlled package content.
5. Malicious package installation logic or imported runtime code executes with the privileges of the invoking account.

Impact Assessment

Successful exploitation could provid ...[truncated 623 chars]

Remediation

View remediation

Remediation Suggestions

1. Define dependencies in a version-controlled requirements or lock file with exact, reviewed versions.
2. Record and enforce cryptographic hashes, for example with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Instruct users to create and activate a dedicated virtual environment before installation:

   bash

   python3 -m venv .venv
   . .venv/bin/activate
   

4. Document the expected trusted package index and caution against untrusted or unexpectedly configured extra indexes.
5. Audit and pin transitive dependencies as well as the direct dependency.
6. Include the chart-generation scripts referenced by the documentation in the Skill package so their implementation and actual dependency requirements can be reviewed.
7. Use automated dependency scanning and a controlled update process before changing pinned versions.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Claiming complete local-only operation while requiring an LLM API is a material security misrepresentation. Users may feed sensitive business or personal data into the skill under false assumptions, causing confidentiality loss if prompts or datasets are sent to an external provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill metadata and user-facing content are presented in Chinese throughout, with no indication that language is selectable or that the skill is intended only for a Chinese-language audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance says to use the skill whenever there is a need for data analysis, report generation, statistical insight, or data visualization. These are very broad everyday work contexts and do not clearly distinguish when this specific chart skill should activate versus other analysis or reporting skills.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill repeatedly claims to be fully local and not use the network, yet its documented interface includes a callback_url field. For a local charting tool, introducing a network callback creates a hidden outbound communication path and undermines the privacy guarantees users are told to trust.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

An asynchronous callback URL is not justified by the stated functionality of an offline chart generator and creates an unnecessary capability for outbound communication. Such an interface can be abused to exfiltrate chart data, metadata, or execution results to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest declares '无需网络，完全本地运行', yet the troubleshooting guidance assumes network failures as a relevant operational mode. That creates a direct contradiction about whether networking is part of normal or supported behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file states the tool is fully local, needs no network, and has no external service calls, but also declares an LLM API as a required dependency. This contradiction is security-relevant because it can mislead users into exposing data to external services while believing processing remains entirely on-device.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The error handling advice tells users to run ping and troubleshoot connectivity, which suggests expected network interaction. That capability is out of place for a chart generator described as requiring no network and no external service calls.

Content

No source excerpt is available for this finding.