Security audit

a2f

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but it sends local PDFs and prompts to an external API with weak upfront disclosure and no explicit confirmation guard.

Install only if you are comfortable sending selected PDFs, extracted character data, prompts, job IDs, and generated-output requests to wuji.cyphy.com. Do not use it with confidential, regulated, private, or copyrighted PDFs unless you have authorization and understand the service's data handling. Prefer running it only on explicit requests and review any file path before allowing upload.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill clearly performs outbound network operations to a third-party API (`https://wuji.cyphy.com/api`) for PDF upload, prompt submission, and job polling, yet no corresponding permissions are declared in the manifest. This creates a transparency and governance gap: users and hosting platforms may not realize sensitive documents and prompts are transmitted externally, undermining consent, policy enforcement, and security review.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Several triggers are broad enough to cause unintended invocation, such as `a2f`, `character generation`, or `extract character features`, which may match unrelated user requests. Because this skill uploads PDFs and prompts to an external service, accidental activation can lead to unintentional data transfer or confusing tool use without clear user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The overview and workflow describe uploading PDFs and generating images, but do not clearly warn that uploaded PDFs and prompts are sent to an external API service. Since PDFs may contain sensitive or copyrighted material and prompts can encode personal data, missing disclosure increases privacy, compliance, and consent risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The code opens a local PDF and sends its full contents to a remote API endpoint (`/archiveData`) without any in-band warning, consent prompt, redaction step, or documentation at the transmission point. Because PDFs may contain sensitive personal, copyrighted, or confidential material, silent exfiltration to a third-party service creates a real privacy and data-handling risk in this skill context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The example automatically uploads a local PDF to a remote API using authentication headers, but only prints generic progress messages and gives no explicit disclosure, consent prompt, or warning about data leaving the local environment. In a skill handling documents, this can cause unintended exfiltration of sensitive content, especially if users run the example with real files or inherited credentials.

Static analysis

No suspicious patterns detected.