视觉笔记卡片生成器

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:50 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent visual-card generator, but its PNG exporter opens active HTML in an unsandboxed browser and the template loads third-party code, so users should review it before installing.

Install only if you are comfortable with generated cards loading Google Fonts and CDN JavaScript, and run the PNG exporter in a restricted environment without sensitive files or credentials. Prefer vendoring html2canvas/fonts locally, pinning dependencies, and removing the Chromium no-sandbox flags before routine use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/html2png.py:43

Finding

Chromium Sandbox Disabled While Rendering Active HTML Content

Content

View full analysis

document.fonts.ready.then(() => document.fonts.check('16px "Noto Sans SC"'))""", timeout=15000, ) ``` ### Technical Analysis The renderer accepts a path to an HTML document and loads that document into Chromium with JavaScript enabled. Chromium is explicitly launched with both `--no-sandbox` and `--disable-setuid-sandbox`. The browser sandbox is a defense-in-depth boundary designed to limit the operating-system access available to compromised renderer processes. Disabling it does not, by itself, create arbitrary code execution, but it substantially increases the impact of a Chromium vulnerability or malicious browser resource. This risk is material because: - The input HTML may contain active JavaScript. - Generated cards are required to include a remote JavaScript dependency. - The loaded page is allowed to make network requests. - The input path can point to arbitrary HTML supplied to the command-line tool. - No HTML validation, script restriction, or network-request filtering is applied before rendering. ### Attack Path 1. An attacker causes crafted HTML or attacker-influenced content to be supplied to `html2png.py`. 2. The script resolves the supplied path and opens the document through a `file://` URL. 3. Chromium executes scripts contained in the document and loads permitted remote resources. 4. Malicious JavaScript triggers a suitable Ch ...[truncated 1104 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: assets/template.html:613

Finding

Remote JavaScript Dependency Loaded Without Integrity Verification

Content

View full analysis

``` The skill documentation instructs users to install Playwright and Chromium without a pinned package version or verified artifact: ```text Dependencies: playwright (pip install playwright && playwright install chromium). Pre-installed on Claude's compute environment. ``` The renderer documentation similarly states: ```python """ Dependencies: pip install playwright && playwright install chromium """ ``` ### Technical Analysis The generated HTML executes `html2canvas` directly from a public CDN. Although the URL includes version `1.4.1`, the template does not provide an `integrity` attribute. Consequently, the browser relies exclusively on the CDN and TLS infrastructure to deliver the expected bytes. If the CDN account, hosting infrastructure, DNS/TLS path, or referenced artifact is compromised, the effective JavaScript payload can change after the skill has been reviewed. The altered code would execute whenever a generated card is opened with network access. It would also execute when `html2png.py` renders that card because Playwright loads the HTML and waits for network activity. The documented Playwright installation commands also do not pin an exact Python package version or independently verify the downloaded Ch ...[truncated 2467 chars]

Remediation

View remediation

``` 2. If CDN loading must be retained, add a verified Subresource Integrity hash and CORS configuration: ```html ``` The hash must be generated or obtained from a trusted source and verified against the exact intended artifact. 3. Bundle font files locally where licensing permits. This improves reproducibility, reduces privacy leakage, and allows rendering without outbound network access. 4. Pin the exact Playwright version in a lockfile or requirements file, for example: ```text playwright== ``` 5. Use a controlled build process that verifies package hashes, such as pip requirements with `--require-hashes`. 6. Pin and verify the Chromium revision associated with the reviewed Playwright release. 7. Apply a restrictive Content Security Policy to generated HTML, limiting scripts, fonts, images, and connections to the minimum required sources. 8. Block outbound network access during automated rendering after all required dependencies and assets have been vendored locally. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Claude Code:

bash

rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

Claude Code:

bash

rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 74)May include surrounding context.

Claude Code:

bash

rm -rf ~/.claude/skills/visual-note-card

OpenClaw:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 80)May include surrounding context.

OpenClaw:

bash

rm -rf ~/.openclaw/skills/visual-note-card

Usage

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description says the skill creates visual note cards/infographics and produces both a self-contained HTML file and PNG image. However, the provided code chunk is solely an exporter: it loads an existing HTML file from disk, waits for fonts, optionally hides UI elements, and screenshots either the .poster element or the full page to PNG. This supports only the PNG export portion of the description and lacks any logic for generating the HTML, summarizing content, or creating infographic layouts. Therefore the code’s actual behavior is materially narrower than the declared primary purpose.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 1)May include surrounding context.

html

<!--
  VISUAL NOTE CARD TEMPLATE
  ==========================
  This is the canonical reference template. When generating a new card,

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README states that the skill generates "professional Chinese visual note cards," which indicates a language-specific output constraint. The document does not clearly present this as optional or user-selectable, so it may violate language/locale policy expectations when users have not explicitly opted into Chinese output.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase "Any request to summarize content into a structured visual card format" is broad and lacks clear boundaries, making it unclear when the skill should activate versus when a general summarization request should not. This can cause unintended invocation for common summarization requests that are not specifically asking for this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are excessively broad and can capture generic summarization or article-processing requests that users did not intend for this skill. Over-broad activation increases the chance that external HTML/PNG rendering workflows, template loading, or export steps run in contexts where a simpler text response was expected, expanding attack surface and creating opportunities for prompt-routing abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction states that all text is Chinese except for limited elements, which imposes a language policy regardless of the user's preferred language. This is a natural-language policy concern because it forces a specific locale without documenting user choice, opt-in, or a region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML root sets lang="zh-CN", and the template also contains Chinese-only UI strings, which imposes a specific language/locale on generated output. The file does not indicate that this locale is optional, user-selected, or required for a region-specific use case.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The template imports Google Fonts at runtime, which contradicts the claim of producing self-contained HTML and causes the generated file to contact a third party when opened. This can leak viewer metadata such as IP address and user-agent, break in offline/restricted environments, and weaken integrity because rendering depends on an external service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The export feature depends on html2canvas loaded from a public CDN, so opening the template executes third-party JavaScript rather than a fully self-contained implementation. This creates supply-chain and privacy risk, and the feature may fail in air-gapped or CSP-restricted environments despite the skill promising portable standalone output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file contains natural-language usage instructions, examples, and later CLI descriptions solely in Chinese. The policy allows locale constraints only when the skill offers opt-in or clearly documents a justified region-specific limitation, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The argparse description and argument help strings are all in Chinese, which creates a language-specific UX policy issue in the absence of a documented locale constraint. There is no mechanism for the user to choose language or any stated regional requirement.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:80