Security audit

图表制作大师

Security checks for vulnerabilities and agentic risk

Overview

This SVG diagram skill mostly matches its stated purpose, but it asks for broad command execution and has unclear privacy and external-resource behavior that users should review before installing.

Install only if you are comfortable granting this skill command-execution capability and reviewing generated SVGs before sharing or embedding them. Prefer offline font settings, avoid sensitive content in diagrams that may be rendered with remote font imports, and treat diagram labels from untrusted sources as unsafe unless escaped or sanitized.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:200
Finding: Unescaped Diagram Content May Enable Active SVG Injection
Content: View full analysis
名称描述 ``` ```svg 条件? ``` ```svg `PostgreSQL` ``` ### Technical Analysis The skill directs the agent to place diagram names, descriptions, conditions, and other user-derived values directly into SVG markup. It does not require XML escaping, attribute encoding, URL validation, or sanitization of raw SVG elements. SVG is an active XML format rather than a passive image format. If an attacker-contr ...[truncated 1584 chars]
Remediation: View remediation
`, ``, event-handler attributes such as `onload`, external `href` values, unsafe CSS, and unknown namespace declarations. 6. Permit only fixed local fragment references for markers, gradients, and patterns. 7. Render generated SVG in a sandboxed or isolated environment before distribution. 8. Add adversarial tests covering element termination, attribute breakout, external-resource loading, script elements, event attributes, and malformed XML. ]]>

other

Note

Location: SKILL.md:315
Finding: Remote Font Loading Contradicts Self-Contained and Local-Only Privacy Claims
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:22
Finding: General Shell Execution Permission Exceeds the Skill's Documented Requirements
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation/scope language is overly broad and extends beyond diagram generation into generic file handling, document conversion, format conversion, and content extraction. In an agent environment with read/exec/write permissions, this can cause the skill to trigger in unrelated contexts and perform unnecessarily powerful operations on arbitrary user files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly defines '中文文本适配' and states the work is '完全中文化表达' elsewhere, but does not offer an opt-in or alternative language mode for users who may want English or another locale. This is a natural-language locale constraint presented as a default behavior without documented user choice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation makes conflicting security and privacy claims: it says generation is local and does not upload data, yet elsewhere allows a callback URL, recommends network troubleshooting, and depends on online Google Fonts. This can mislead users into exposing sensitive diagram content or enabling outbound network access they did not expect, undermining trust and policy compliance.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises self-contained SVG with embedded fonts and no external dependency, but later states that Google Fonts may be imported online. This discrepancy can cause users to embed remote references into documents they expect to be self-contained, creating privacy leakage and availability risks when rendered.
Content: No source excerpt is available for this finding.