Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious with high confidence, chiefly because it reports an unauthenticated screenshot server that may expose local files and several capabilities that do not match the declared character-design purpose.
Consider the Review verdict carefully before installing. The reported local-file disclosure risk and undisclosed capabilities are the main concerns; asset uploads to hosted services may also expose private or identifiable material. The scan was partial, so it does not establish that uninspected content is safe.
code/shoot.tsUnauthenticated screenshot server permits directory traversal and local file disclosure
An attacker can retrieve files outside code/, potentially including private project data or credentials readable by the process. Wildcard CORS additionally permits cross-origin response reading where browser network protections allow the request.
The supplied code's primary purpose is statistical evaluation of judges, not character or prop design. It contains no character passports, visual sheets, expression or voice specifications, prop descriptions, or passport-preserving prompt builder. Although agreement analysis could support a broader quality-assurance workflow, the code is generic and has no visible connection to the declared character-design workflow, making this a material purpose mismatch. Its file access is limited to the JSON paths supplied on the command line; no network access or code execution is shown.
Although 3D assets could support character or prop workflows, the description does not disclose image-to-3D conversion or external image processing. This chunk implements that distinct capability rather than the declared design-document and consistency workflow. References to three.js and VRM do not adequately describe generating a textured model through a hosted service.
Although 3D assets could support character or prop workflows, this chunk implements a distinct image-to-mesh generation capability rather than the described design-package or rigging workflows. Mentioning three.js and VRM does not adequately disclose hosted 3D reconstruction or the associated external image upload. The mismatch is the additional capability and resource use, not simply that this individual chunk omits other advertised features.
Face consistency is related to the declared workflow, but the supplied script implements a substantive, undeclared biometric identity-verification capability rather than generating or enforcing character design specifications. The description does not disclose face recognition, identity embeddings, or same-person classification. The code processes supplied image files and writes local results; no explicit image upload or exfiltration is present.
Referenced artifact was not completely inspected
[references/voice.md](references/voice.md).
Referenced artifact was not completely inspected
- `references/voice.md`: the voice line, pace numbers, accents, verbal habits, TTS models
Referenced artifact was not completely inspected
- `references/x-evidence.md`: 200+ techniques from X by topic, verbatim, with links and metrics
Referenced artifact was not completely inspected
- `references/judge-evidence.md`: the research behind judge.md (biases with numbers, VLM failure modes, sources)
Referenced artifact was not completely inspected
image-to-3D client scripts, and `shoot.ts` (Bun + Playwright headless renderer)
Networking is necessary for the renderer, but the server does not explicitly bind to loopback and returns permissive CORS headers. More seriously, it concatenates decoded request paths with the serving directory without containment validation, allowing encoded traversal requests to potentially expose files outside that directory to reachable clients.
The installation example invokes an unpinned npm executable, allowing the code executed during installation to change without changes to this skill. This is a supply-chain exposure rather than an unversioned MCP server, and exploitation would require a malicious or compromised package release.
The workflow directs the agent to submit reference assets and takes to three model families without identifying the judging services or requiring approval for this additional sharing. For confidential client designs or approved real-person references, following this instruction could distribute sensitive assets beyond the generation service the user expected.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
"beautiful", "perfect", "stunning", "flawless", "cinematic" in a passport · a celebrity's or a living actor's name ·
paraphrasing a passport between shots · props in the character's hands on the sheet · two looks on one sheet ·
expressions as bare adjectives · a voice without a measured take · brand names (they draw logos) · real people's
faces without consent.
## Files in this skill
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Name three things: first language or region, social setting, and 2-3 audible features (r, vowels, th, stress,
intonation). "Light" or "strong". No script checks an accent: a person listens once before approval. For a real
reference of an accent, use the Speech Accent Archive or IDEA (reference-sites.md) and describe what you hear;
do not clone a real speaker's voice without consent.
## Verbal habit
The documented uvx command resolves and executes an unspecified version of gradio_client. This creates a dependency supply-chain exposure if a future release is compromised, although it is not an MCP server configuration.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
document.body.appendChild(renderer.domElement);
const scene = new THREE.Scene();
const ph = (asset) => fetch(`https://api.polyhaven.com/files/${asset}`).then(r => r.json());
const [tex, hdriFiles, pbList] = await Promise.all([
ph('green_metal_rust'), ph('studio_small_09'),
fetch('https://api.physicallybased.info/materials').then(r => r.json()).catch(() => []),
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
code/prop_pbr.png (a worn tackle box with brass fittings, in 3/4, side and top views).const tex = await fetch('https://api.polyhaven.com/files/green_metal_rust').then(r => r.json());
const paint = new THREE.MeshStandardMaterial({ map: diff /* tex.Diffuse['1k'].jpg.url */, roughnessMap: rough, normalMap: nor, metalness: 0.3 });
const brass = (await fetch('https://api.physicallybased.info/materials').then(r => r.json())).find(m => m.name === 'Brass');
new THREE.MeshStandardMaterial({ color: new THREE.Color().setRGB(...brass.color, THREE.SRGBColorSpace), metalness: 1, roughness: 0.42 });
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
se=cc0`). Also CC BY, CC BY-NC, Free Standard | Search yes, download no | `curl "https://api.sketchfab.com/v3/search?type=models&q=helmet&downloadable=true&license=cc0&count=6"` | 6 CC0 helmets. "lantern": 6 | **Yes** for search and thumbnails (245 KB) | `/v3/models/{uid}/download` returns **401 without a free account token**. "fisherman" + characters + cc0 returned 0 |
| **Poly Haven** API | CC0 props (521 models: lantern, camera, wrench, cart…), textures, HDRIs | CC0 | Yes | `curl -A "myapp" "https://api.polyhaven.com/assets?t=models"` then `.../files/Lantern_01` | 521 models. 6 leather textures | **Yes**, glTF + thumbnail DL | CORS is open, so three.js can load it straight in the browser (used in Part 2) |
| **ambientCG** API | CC0 PBR materials (rust, leather, fabric, skin-like, wood) | CC0 | Yes | `curl "https://ambientcg.com/api/v2/full_json?type=Material&q=rust&limit=6&include=downloadData"` | 58 (v3 `/api/v3/assets?q=rust` gives 66) | **Yes**, 5.6 MB zip | The zip holds Color,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const ph = (asset) => fetch(`https://api.polyhaven.com/files/${asset}`).then(r => r.json());
const [tex, hdriFiles, pbList] = await Promise.all([
ph('green_metal_rust'), ph('studio_small_09'),
fetch('https://api.physicallybased.info/materials').then(r => r.json()).catch(() => []),
]);
const env = await new HDRLoader().loadAsync(hdriFiles.hdri['1k'].hdr.url);
env.mapping = THREE.EquirectangularReflectionMapping;
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const tex = await fetch('https://api.polyhaven.com/files/green_metal_rust').then(r => r.json());
const paint = new THREE.MeshStandardMaterial({ map: diff /* tex.Diffuse['1k'].jpg.url */, roughnessMap: rough, normalMap: nor, metalness: 0.3 });
const brass = (await fetch('https://api.physicallybased.info/materials').then(r => r.json())).find(m => m.name === 'Brass');
new THREE.MeshStandardMaterial({ color: new THREE.Color().setRGB(...brass.color, THREE.SRGBColorSpace), metalness: 1, roughness: 0.42 });
scene.environment = await new HDRLoader().loadAsync(hdri.hdri['1k'].hdr.url); // r187: HDRLoader (RGBELoader still ships)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
typically set to 0.04 (linear) 4% reflective."; "The reflectance value for raw metal is going to be high, in the range of 70-100% specular, which we can map to 180-255 sRGB."; dark values "should not go under 30-50 sRGB", bright values not "higher than 240 sRGB"; "The roughness map describes the surface irregularities that cause light diffusion."; "Metal that is oxidized needs to be treated as dielectric".
- Physically Based database (Anton Palmqvist, CC0): https://physicallybased.info/ and API https://api.physicallybased.info/materials — "A database of physically based values for CG artists"; values in rule 4 read from the API.
- Adobe Substance 3D Painter, Metal Edge Wear: https://experienceleague.adobe.com/en/docs/substance-3d-painter/using/effects/generators/metal-edge-wear — "creates the appearance of damage and wear on areas of your mesh that are most likely to be knocked or scratched."
- Adobe Substance 3D Painter, Dirt: https://experienceleague.adobe.com/en/docs/substance-3d-pa
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
d it straight in the browser (used in Part 2) |
| **ambientCG** API | CC0 PBR materials (rust, leather, fabric, skin-like, wood) | CC0 | Yes | `curl "https://ambientcg.com/api/v2/full_json?type=Material&q=rust&limit=6&include=downloadData"` | 58 (v3 `/api/v3/assets?q=rust` gives 66) | **Yes**, 5.6 MB zip | The zip holds Color, Roughness, NormalGL/DX, Displacement, Metalness, .blend and .mtlx |
| physicallybased.info API | Real-world material values (brass, skin, rubber…) | CC0-1.0 | Yes | `curl https://api.physicallybased.info/materials` | 86 materials | **Yes** | CORS is open. Used live in the Part 2 prop render |
| **ArtStation** | Professional character sheets, turnarounds, costume and prop concept art | Each artist holds the rights. **Reference only, never copy** | Search page in a browser | — | — | Look only | Many artists explicitly object to AI use: a person browses, describes what they learn (layout, callouts, design language), and never feeds an image in. Scripted access is bl
The suggested uvx invocation installs an unspecified gradio_client version before running the script. A compromised future dependency release could therefore execute with the user's permissions; the issue is dependency resolution, not an MCP server.
The instruction to upload the blockout render selects an actual data-transfer operation, rather than merely listing an available model. The file does not warn that reference artwork and accompanying character descriptions leave the local environment and are processed by a third-party service.
The example uses uvx to resolve and execute an unpinned gradio_client package, allowing the executable dependency to change without review. Although this is a client library rather than an MCP server, a compromised future release or dependency could execute with the invoking user's permissions; no compromised package is demonstrated here.