social-card

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:47 AM UTC
• Version: 0.2.1

Overview

This skill is a coherent local image-generation helper, with ordinary package-install and file-output risks that users should understand.

Install this only if you are comfortable trusting the current social-card package from PyPI. For safer use, install it in a virtual environment, pin the package version, and avoid rendering to paths where replacing an existing image would matter.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:8-11, SKILL.md:29, SKILL.md:48-50, metadata.json:8, and examples/generate_og.py:2-4
Vulnerability Type: Unpinned and unauditable third-party dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:8-11:

yaml

install:
  - kind: uv
    package: social-card
    bins: []

SKILL.md:29 and SKILL.md:48-50:

markdown

> **Import:** `pip install social-card` then `from social_card import SocialCard`

bash

pip install social-card

metadata.json:8:

json

"install": "pip install social-card",

examples/generate_og.py:2-4:

python

from social_card import SocialCard

SocialCard("og").title("Hello World").subtitle("My first social card").render("og.png")

Technical Analysis

The skill instructs the operator or agent to install social-card from an external package registry without specifying an exact version, integrity hash, immutable artifact, or lockfile. The project contains only documentation, metadata, and an example; it does not include the implementation of the imported social_card module.

Consequently, the behavior of the executable dependency cannot be verified from this artifact. The documented claims that the package performs no network access, blocks path traversal, and depends only on Pillow cannot be independently substantiated by auditing the supplied files.

An unpinned command such as pip install social-card resolves package contents at installation time. A future compromised or malicious registry release could execute code during installation or when social_card is imported. The version 0.2.1 in the skill metadata identifies the skill itself but does not constrain the version of the package installed from PyPI.

Attack Path

1. An attacker compromises the publisher account, package repository, release process, or another part of the distribution chain for th ...[truncated 1205 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin social-card to an exact, reviewed version in every installation instruction and metadata declaration.
2. Use a lockfile containing cryptographic hashes for the complete transitive dependency set.
3. Require hash verification during installation, such as a fully pinned requirements file used with pip install --require-hashes.
4. Vendor the reviewed implementation into the artifact or include its source so its security properties can be audited together with the skill.
5. Publish and verify signed release artifacts or provenance attestations where supported.
6. Install the dependency in an isolated, least-privilege virtual environment or container with restricted filesystem and network access.
7. Keep the installation declarations in SKILL.md and metadata.json synchronized and add automated checks that reject unpinned dependencies.
8. Independently verify the documented path, dimension, input-length, file-format, and network-access protections against the exact pinned package release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown skill description repeatedly demonstrates .render("...png"), which saves files to disk, but it does not explicitly warn users that using render() creates or overwrites local image files. Because SQP-2 for markdown covers omitted warnings about behaviors that affect user data or system integrity, a brief disclosure about local file creation would improve transparency.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.