Grok图片生成-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.3

Overview

This skill’s image-generation purpose is clear, but it needs review because it runs an unpinned desktop-control tool and uses blind mouse/keyboard automation to save files locally.

Review before installing. Use this only in a controlled browser/session, avoid running the unpinned `uvx desktop-agent` command until the package source and version are verified, and prefer a safer browser download method or a sandboxed desktop automation environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:152

Finding

Unpinned Third-Party Desktop Automation Package Is Automatically Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 152–162, 223–229, 241–245, and 310
Vulnerability Type: Unpinned third-party dependency with desktop-control capabilities
Risk Level: High

Vulnerable Code

bash

# Step 1: Move the mouse to the image and right-click
uvx desktop-agent mouse move 720 400
uvx desktop-agent mouse right-click
sleep 1

# Step 2: Select "Save image as"
uvx desktop-agent keyboard press down --presses 2
uvx desktop-agent keyboard press return
sleep 1

# Step 3: Confirm save
uvx desktop-agent keyboard press return

The same desktop automation sequence is repeated later:

bash

uvx desktop-agent mouse move 720 400
uvx desktop-agent mouse right-click
sleep 1
uvx desktop-agent keyboard press down --presses 2
uvx desktop-agent keyboard press return
sleep 1
uvx desktop-agent keyboard press return

The dependency documentation explicitly describes automatic installation without a version or integrity constraint:

text

| desktop-agent | Tool | Required | `uvx desktop-agent` (automatic installation) |

Technical Analysis

The Skill invokes uvx desktop-agent without pinning an audited package version, package hash, publisher identity, or trusted package source. Because uvx can resolve, retrieve, install, and execute a package at invocation time, the code that ultimately runs may differ from the code that existed when the Skill was audited.

This creates a supply-chain vulnerability. If the package, publisher account, dependency tree, or configured package index is compromised, attacker-controlled package code could execute under the privileges of the Agent user.

The exposure is amplified because the dependency is used to control desktop input. The instructions use fixed coordinates and blind keyboard actions without validating:

• Which application or window has focus.
• Whether the pointer is positioned over the generated image.
• Whether the expected context menu is open.
• Whether the expected ...[truncated 1799 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin desktop-agent to a specific, reviewed version rather than allowing unconstrained resolution.
2. Verify the package with cryptographic hashes or a locked dependency manifest.
3. Document and enforce the authoritative registry, package owner, and trusted publisher identity.
4. Disable fallback to untrusted or user-controlled package indexes.
5. Install the dependency separately after explicit user approval instead of automatically downloading and executing it during Skill invocation.
6. Review and lock all transitive dependencies.
7. Run desktop automation in a sandbox or isolated user account with minimal filesystem, credential, browser-profile, and network access.
8. Prefer browser DOM automation and an explicit browser download API over operating-system-level mouse and keyboard automation.
9. If desktop automation remains necessary, verify the active process, window title, focused control, dialog type, and intended target before every click or key press.
10. Replace fixed coordinates and menu offsets with accessibility selectors, image recognition, or another validated target-selection mechanism.
11. Require confirmation before actions that can submit, overwrite, authorize, or otherwise alter data.
12. Record the resolved package version and integrity metadata so executed artifacts can be audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level trigger is extremely broad ('efficiency', 'automation', 'workflow optimization') and overlaps with many unrelated user requests. In an agent system, that can cause this skill to be selected unexpectedly, granting browser, read, and exec-backed automation to prompts that did not specifically request image generation or local file-saving behavior.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

prompt += f"，{mood}氛围"
    if details:
        prompt += f"，{details}"
    return prompt

# 示例
prompts = [

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The dedicated trigger section remains ambiguous and lacks concrete invocation constraints, making accidental or overbroad activation likely. This matters more here because the skill combines browser automation, desktop control, and local file writes, so mistaken invocation has real side effects on the host.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description explicitly states '支持中文交互,' and the feature note says the skill includes '中文交互' as a core capability, but there is no indication that other languages are supported or that the user can opt in to Chinese. This can violate language/locale policy when a specific language is imposed without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The line describes '中文交互' as a core capability without clarifying that the language is optional or user-selectable. In the absence of an opt-in or locale justification, this reads as a fixed language behavior and may conflict with organizational language-choice policy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs automatic saving of generated images to local storage without clearly surfacing that it will write files to disk. Hidden or implicit persistence is risky in agent workflows because users may not expect local modifications, and downloaded content could accumulate or overwrite expected state.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The '不支持（需专业版）' section explicitly says batch image generation is unavailable in the free version, yet the later Python example iterates over multiple prompts to generate several images and the trigger description includes '批量处理'. This is an intent/documentation contradiction that could mislead an agent into using the skill for a capability the document says is out of scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill repeatedly instructs use of uvx desktop-agent without pinning a version or package digest. Because uvx resolves and installs code at runtime, an upstream compromise, typo-squat, or breaking update could cause the agent to execute unreviewed code with local desktop-control privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The referenced uvx desktop-agent command is unpinned and is used for mouse control on the local machine. Unpinned runtime installation combined with GUI automation is risky because a compromised package could perform arbitrary actions on the host beyond the intended image-saving workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line invokes the same unversioned desktop automation package in a flow that saves files locally. If the package contents change or are replaced upstream, the agent may execute attacker-controlled code while interacting with the user's desktop and filesystem.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill relies on an unpinned uvx desktop-agent invocation to press keyboard keys, granting effective control over the local GUI. In the context of desktop automation, supply-chain drift is especially dangerous because even small package changes can lead to unauthorized clicks, keystrokes, or exfiltration actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

An unpinned uvx desktop-agent reference is used in a sequence that combines web interaction and local file operations. That creates a credible supply-chain execution path where a malicious or altered package could gain local code execution or misuse UI automation on the endpoint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This unpinned desktop-agent command appears in the quick-start save flow, making it likely to be executed by users or agents as-is. Runtime retrieval of a GUI-control tool from an unpinned source is a supply-chain risk that can translate directly into arbitrary local actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The line uses unversioned desktop automation in a privileged interaction path. Because the package is not pinned, the behavior can change unexpectedly or maliciously, and the local desktop-control capability amplifies the risk beyond a normal utility dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This keyboard automation step depends on the same unpinned package, meaning the skill's security hinges on live package resolution. In a desktop automation context, an attacker-controlled update could issue different keystrokes, open other programs, or manipulate local state.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill's save workflow uses unpinned GUI automation that can alter the user's machine state. If the resolved package is compromised, the combination of keyboard control and filesystem interaction could be abused for arbitrary operations or data access.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The final save confirmation step still depends on an unpinned runtime package with desktop-control capability. That leaves the workflow exposed to supply-chain compromise at the exact point where local file writes are occurring.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The configuration section documents uvx desktop-agent as a standard dependency but does not pin a version. Presenting an unpinned auto-install command as normal setup increases the chance that downstream users execute mutable third-party code with desktop-control privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This line normalizes use of an unpinned desktop-control package for mouse movement. Because desktop automation can interact with any on-screen application, the lack of version pinning creates a substantial supply-chain risk with potentially broad local impact.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unpinned right-click automation command introduces the same mutable dependency risk in a highly privileged context. A compromised update could perform unintended UI actions or chain into other local applications and dialogs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This keypress command depends on an unpinned package with the ability to steer OS dialogs. Such packages should not be fetched dynamically without version locks, because any compromise can translate into host interaction and potentially code execution through the UI.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Another unpinned desktop-agent invocation appears in the common command reference, reinforcing insecure installation/use patterns. Given the tool's broad capability over the desktop, this is more dangerous than an ordinary unpinned library dependency.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The dependency table explicitly recommends uvx desktop-agent with automatic installation, but without any version pinning. That combination creates a straightforward supply-chain risk where unreviewed code is fetched and executed on demand with local desktop-control permissions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill claims capabilities far beyond its stated purpose, including broad file processing, API integration, command execution, and information retrieval. Overstating scope can cause an orchestrator or user to delegate unrelated tasks to a skill that already has exec and browser access, expanding when and how dangerous tools are invoked.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The dependency section says the skill is Markdown-driven and requires no additional API key, aside from an existing logged-in Grok browser session. Later, the security notes discuss API-key management through environment variables, which contradicts the earlier statement about key requirements and obscures the actual operating model.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.