Security audit

图像

Security checks for vulnerabilities and agentic risk

Overview

The skill is not visibly malicious, but it needs review because it combines image generation with unpinned desktop automation and outbound Feishu file sending without tight controls.

Review before installing. Use this only in an isolated or low-risk desktop session, avoid sensitive prompts or images, pin and verify the desktop automation dependency, and require manual confirmation of the exact Feishu recipient and file before sending.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:111
Finding: Unpinned Third-Party Package Is Dynamically Retrieved and Executed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:111-140
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

bash
uvx desktop-agent screen size # ... uvx desktop-agent mouse move <x> <y> # ... uvx desktop-agent mouse right-click

bash
uvx desktop-agent keyboard press down --presses 2 uvx desktop-agent keyboard press return

bash
uvx desktop-agent keyboard press return

bash
uvx desktop-agent mouse move 720 400 uvx desktop-agent mouse right-click sleep 1 uvx desktop-agent keyboard press down --presses 2 uvx desktop-agent keyboard press return sleep 1 uvx desktop-agent keyboard press return

Technical Analysis

The skill directs the agent to invoke desktop-agent through uvx without specifying an exact package version or an integrity-verified lock file. uvx can resolve and execute a third-party Python package on demand. Consequently, the code executed during a future skill invocation may differ from the package version that existed when this document was reviewed.

If the upstream package, package registry account, distribution channel, or a newly resolved release is compromised, attacker-controlled package initialization or command-handling code could run under the invoking user's operating-system account. The risk is amplified because the package is intentionally used for desktop interaction, including mouse and keyboard control.

No evidence establishes that the current desktop-agent package is malicious. The confirmed issue is the unsafe, unpinned supply-chain execution pattern.

Attack Path

An attacker compromises the upstream package, its publisher account, or its distribution channel and publishes a malicious release.

An agent follows SKILL.md and executes an unversioned command such as uvx desktop-agent screen size.

uvx resolves and obtains the current p ...[truncated 936 chars]
Remediation: View remediation
Remediation Suggestions

Pin desktop-agent to an exact, reviewed version in every invocation rather than allowing resolution of the latest release.

Manage the dependency through a committed lock file containing cryptographic hashes, and require hash verification during installation.

Document and restrict the trusted package index or registry. Disable fallback to unapproved package sources.

Prefer installing the reviewed dependency during a controlled provisioning phase instead of dynamically retrieving it while the skill runs.

Execute desktop automation in a sandbox or isolated user account with minimal filesystem, environment-variable, network, clipboard, and application access.

Maintain an allowlist of permitted desktop operations and require user confirmation before sensitive keyboard or mouse actions.

Periodically review the pinned release and update it only after source, package metadata, publisher identity, and integrity checks have been completed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The invocation guidance uses broad language like improving efficiency, automation, batch processing, and workflow optimization, which can cause the skill to be selected for many unrelated requests. That is dangerous here because the skill exposes powerful capabilities such as execution, file handling, desktop automation, and outbound messaging, increasing the chance of unintended or overbroad activation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill is presented primarily as image generation, but the content also includes message sending, batch distribution, and file-handling behavior that materially expand its capabilities. This mismatch can mislead users or calling agents about what the skill may do, weakening informed consent and tool-governance controls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs saving files locally and sending them to Feishu but does not provide a strong, user-facing warning that data will be stored on disk and potentially transmitted externally. That weakens user consent and increases the risk of accidental exposure of sensitive prompts, images, or metadata through local persistence and outbound sharing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill documents desktop-control and shell execution for GUI automation, file saving, and filesystem inspection, which goes well beyond ordinary image generation. This significantly increases risk because it enables local system interaction through clicks, keypresses, and shell commands that could be repurposed for broader host actions if misused or if the automation dependency is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs use of uvx desktop-agent without pinning a specific version or immutable source. That allows future or substituted package versions to change behavior unexpectedly, which is especially risky here because the tool is granted GUI control and can click, type, and interact with local files.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned uvx desktop-agent invocation exposes users to supply-chain risk from package updates or package name hijacking. Because the command performs mouse movement and system interaction, a malicious or compromised version could take unauthorized local actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The documentation relies on an unversioned desktop-agent package for keyboard automation. Unpinned execution tools are dangerous because users may silently pull different code over time, and in this context that code can directly manipulate the desktop session.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The example again invokes uvx desktop-agent without a fixed version, creating repeatable supply-chain exposure. Since the skill encourages automated GUI operations, compromise of that dependency could lead to unintended clicks, downloads, or data access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned right-click automation step inherits the same dependency trust problem as the other desktop-agent invocations. A malicious package update could alter behavior while retaining the same interface, making abuse hard to notice during routine skill execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The keyboard automation command is executed through an unpinned uvx package reference. In a workflow that handles downloads and desktop interactions, this creates a realistic path for supply-chain compromise to affect the host system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This line repeats use of unpinned GUI automation software. The risk is amplified by the skill's broad tool permissions (exec, write) and its instructions to interact with the desktop and filesystem, increasing the consequences of a compromised dependency.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned desktop-agent command for mouse interaction creates avoidable supply-chain risk. Because the skill normalizes direct desktop control, any compromised package version could convert a simple image workflow into local unauthorized actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The command invokes desktop-agent without fixing the package version, so the executable behavior is not reproducible or reliably trusted. In a local automation context, that uncertainty can expose users to file access, input simulation, or other unintended actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The save-image workflow depends on a mutable external package reference. If that package is compromised, the tool could manipulate save dialogs, file paths, or other desktop elements in ways that exfiltrate or overwrite data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Another unpinned desktop-agent invocation appears in the example sequence, reinforcing a repeated supply-chain weakness rather than an isolated oversight. The surrounding workflow includes file discovery and later file transmission, so compromised automation could meaningfully affect confidentiality and integrity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill includes a workflow to send locally saved images to Feishu, which introduces external data transmission beyond simple image creation. In context, that creates confidentiality risk because generated or downloaded files may be transmitted off-host without strong user-facing consent, destination validation, or data-classification checks.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Vague Triggers

Intent-Code Divergence

Missing User Warnings

Context-Inappropriate Capability

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Rp1

Context-Inappropriate Capability

Static analysis