flashcards-word

• Outcome: Pass
• Latest audit: Aug 30, 2026 · 2:59 PM UTC
• Version: 0.1.0

Overview

This is a straightforward flashcard generator, but it should be installed with awareness that it runs local Python commands, downloads emoji artwork, and uses loosely pinned dependencies.

Install in a dedicated project or temporary directory, review or pin dependency versions before use, and avoid setting EMOJI_OUT or OUT_DOCX to sensitive locations. Expect the skill to contact jsDelivr/Twemoji for artwork and to overwrite its generated emoji, front, back, and DOCX outputs when re-run.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tainted flow: 'OUT' from os.environ.get (line 19, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

report[w] = 1
if report: print("WARN unresolved:", list(report))

json.dump(final_map, open(f"{OUT}/_final.json", "w"), ensure_ascii=False, indent=1)

def md5(p): return hashlib.md5(open(p, "rb").read()).hexdigest()
seen, dups = {}, []

• Confidence: 84% confidence
• Finding: The output directory is taken from EMOJI_OUT without validation, and the script writes files into that location. If an attacker can control the environment in which the script runs, they may redirect writes to unintended filesystem locations, causing overwrite, data clobbering, or planting files in sensitive directories accessible to the current user.

Tainted flow: 'final' from os.environ.get (line 36, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

def get_png(cp):
    final, svg = f"{OUT}/{cp}.png", f"{OUT}/{cp}.svg"
    if curl(svg, f"{BASE}/svg/{cp}.svg") == "200" and os.path.getsize(svg) > 100:
        subprocess.run(["rsvg-convert","-w","256","-h","256","-o",final,svg], capture_output=True)
        os.remove(svg)
        if os.path.exists(final) and os.path.getsize(final) > 150:
            return "svg256"

• Confidence: 78% confidence
• Finding: The final output path passed to rsvg-convert is derived from the unvalidated OUT environment variable. While this is not command injection because arguments are passed safely, it still allows a caller controlling the environment to direct the converter to write arbitrary files within the privileges of the running user, which can lead to file overwrite or persistence in unexpected locations.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill clearly instructs the agent to read and write files, inspect environment state, and execute shell commands, yet no permissions are declared. That creates a trust and policy gap: users or orchestration layers may treat the skill as low-privilege while it actually requires filesystem and command execution, increasing the chance of unintended local changes or command misuse.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence
• Finding: The skill description overstates its scope and containment: it claims both English and Chinese support and a self-contained/open-source-ready pipeline, but the content admits the bundled scripts are English-only and depend on external tools and network downloads from a CDN. This mismatch can mislead reviewers and users about what will execute and what external connectivity or dependencies are involved, weakening informed consent and supply-chain scrutiny.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: This script performs live downloads from an external CDN even though the skill is described as local/self-contained. That mismatch increases supply-chain and privacy risk because execution depends on third-party content availability and integrity, and users may run the skill believing it has no network behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9
python-docx>=0.8

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound, which makes builds non-reproducible and can pull in different versions over time. In a document-generation skill that processes text and may handle image assets, this increases supply-chain risk and can also permit installation of older vulnerable versions such as Pillow 9.x depending on resolver behavior and environment constraints.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

Pillow>=9
python-docx>=0.8

• Confidence: 93% confidence
• Finding: Using an unpinned minimum version for python-docx allows dependency drift and inconsistent installs across environments. Because this skill generates .docx files from user input, dependency ambiguity increases the chance of deploying a version with known parser or XML-handling weaknesses or introducing unexpected behavior from future releases.

Known Vulnerable Dependency: Pillow==9 — 10 advisory(ies): CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2024-28219 (Pillow buffer overflow vulnerability); CVE-2026-55379 (Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()`) +7 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The requirement `Pillow>=9` permits installation of Pillow 9.x, and the static finding indicates that 9.x includes multiple serious advisories, including memory-safety and possible code-execution issues. In this skill, Pillow is used for image generation/manipulation; if any untrusted image/font/content is processed, vulnerable versions could be triggered by crafted input, making the context more dangerous rather than less.

Known Vulnerable Dependency: python-docx==0.8 — 2 advisory(ies): CVE-2016-5851 (Improper Restriction of XML External Entity Reference in python-docx); CVE-2016-5851 (python-docx before 0.8.6 allows context-dependent attackers to conduct XML Exter)

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: The finding maps python-docx 0.8 to known XXE-related issues, and the current spec `python-docx>=0.8` allows selection of the vulnerable baseline version in some environments. Since the skill creates Word documents and may interact with XML-backed .docx structures, use of an XXE-vulnerable release could expose local file contents or network resources if untrusted document content is ever parsed or manipulated.

Static analysis

No suspicious patterns detected.