Security audit

covercraft-skill

Security checks for vulnerabilities and agentic risk

Overview

This is a Chinese-oriented thumbnail and cover-design workflow with optional local helper scripts, and I found no hidden persistence, credential theft, network execution, or destructive behavior.

Use this skill if you want a Chinese-focused cover and thumbnail workflow. Run the optional scripts only on files or directories you intentionally choose, preferably in a virtual environment with reviewed or pinned dependencies if installing Pillow or openpyxl.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

Location: scripts/thumbnail_technical_qc.py:29
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation
``` 2. Use a lockfile or hash-verified requirements file to ensure reproducible installation: ```text Pillow== \ --hash=sha256: ``` 3. Replace the generic installation message with instructions referencing the project's reviewed dependency file: ```python raise RuntimeError( "Pillow is required. Install the reviewed dependencies with " "`python -m pip install --require-hashes -r requirements.txt`." ) from exc ``` 4. Recommend installation inside a dedicated virtual environment rather than into a system-wide Python environment. 5. Document the expected trusted package index and advise users to review pip configuration, mirrors, and proxies before installation. 6. Add automated dependency scanning and periodic review of pinned versions so security updates can be adopted without silently resolving arbitrary future releases. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 4)May include surrounding context.
text
.DS_Store __pycache__/ *.pyc .env outputs/*.png outputs/*.jpg

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states '默认生成无字底图，中文标题应由后期工具添加', which establishes Chinese titles as the default behavior. Under the policy, forcing a specific language or locale without offering user choice or opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill references local helper scripts and static analysis detected file_read/file_write capabilities, but the manifest does not declare any tool scope or permissions boundary. This creates an authorization ambiguity where an agent may access filesystem operations more broadly than a user would expect, especially during batch brief generation or prompt export workflows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest specifies language: zh-CN, indicating a fixed locale. There is no accompanying statement offering users a language choice or clarifying that the locale is optional, which can violate language/locale policy when applied broadly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill whenever the user wants to "analyze, design, optimize, recreate-in-spirit, or batch-produce" covers across many platforms and content types. While domain-related, the trigger scope is expansive and lacks explicit exclusions or negative examples, which can cause unintended invocation for generic design-help requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The operational guidance and output templates are entirely in Chinese and do not state that responses can switch languages based on user preference. Without an opt-in or multilingual fallback, the skill appears to enforce a locale-specific experience.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation list provides positive examples only, including short everyday-style requests that could overlap with many ordinary content-creation conversations. Because the file does not pair these with clear exclusions in the activation section, it leaves ambiguity about when this skill should activate versus a more general creative assistant.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file is entirely written in Chinese, including the headings and structure, with no indication that the user can choose another language or that the skill is intended only for a Chinese-speaking context. This can violate a language/locale policy when users are not given opt-in or a documented justification for the constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The JSON report's user-facing notes are written in Chinese, which imposes a specific language on the consumer of the skill output. There is no indication in this file that the language is configurable, optional, or justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The report title and explanatory text are written entirely in Chinese, and the file provides no indication that the language choice is optional or limited to a justified region-specific context. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file embeds Chinese title categories, platform defaults, user-facing markdown content, and generated prompt text throughout the script. This effectively forces Chinese-language behavior for generated outputs without any visible user opt-in or locale selection, which matches the language/locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This code emits user-facing notes and the generated markdown report entirely in Chinese, including quality warnings and the report title. Because the script does not offer language selection or explain that it is intended only for Chinese-speaking users, it imposes a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The JSON explicitly sets a negative constraint of "Chinese text" in the generated output, which imposes a language restriction without indicating any user choice or opt-in. This is a natural-language policy concern because it hard-codes a locale/language outcome rather than offering a selectable preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file contains user-facing skill documentation exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file contains user-facing instructions and output content exclusively in Chinese, and there is no indication that the skill offers language selection or that it is intentionally restricted to a Chinese-language audience. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file presents all instructions and prompts exclusively in Chinese, which can amount to a language/locale constraint without user opt-in. The content does not state that the skill is region-specific or provide an option to use another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The entire skill file is written as a fixed Chinese-language template and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the regional constraint is explicit and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This JSON content is predominantly authored in Chinese and includes multiple Chinese-only title, notes, and emotion fields, while also mixing in other platforms and English fields. For a general-purpose skill artifact, this can indicate a language/locale constraint without any explicit user opt-in or justification in the file itself.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file description explicitly defines a "universal Chinese prompt" alongside English output, and the implementation later defaults many generated fields to Chinese text. This imposes a language choice in the skill behavior without offering the user a language/locale option or documenting it as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown template presents all user-facing instructions and fields exclusively in Chinese. Under the natural-language policy rule, forcing a specific language without opt-in or justification can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The sample titles are presented entirely in Chinese and there is no indication in the file that language selection is optional or limited to a China-specific use case. This can violate a language/locale policy if the skill consumes these titles as defaults without giving users a choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.