Brand Kit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:44 AM UTC
• Version: 1.0.0

Overview

The skill is a legitimate brand-asset generator, but its renderer weakens browser isolation while processing local SVG files, so it should be reviewed before installation.

Install only if you trust the projects whose SVG files will be rendered. Prefer running the renderer in a disposable or low-privilege workspace, keep Edge updated, avoid using attacker-supplied SVGs, review any personal contact details before generating public assets, and confirm cleanup or rm steps before allowing deletion.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render_svg_to_png.py:114

Finding

Project-Controlled SVG Files Are Rendered by Edge with the Browser Sandbox Disabled

Content

View full analysis

` elements - Event-handler attributes such as `onload` or `onclick` - `` content - ...[truncated 2119 chars]

Remediation

View remediation

` - `` - All `on*` event-handler attributes - External `href` and `xlink:href` values - `javascript:`, `file:`, and remote URI schemes - XML document type declarations and external entities 5. Allow only a documented subset of static SVG elements and attributes needed for brand graphics. 6. Disable browser networking during rendering through operating-system isolation or a container with no network access. 7. Execute the renderer under a dedicated low-privilege account or inside a disposable container or virtual machine. 8. Keep Edge updated and fail closed when safe isolation cannot be established. 9. Validate that input paths resolve beneath the intended project root before reading them. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/render_svg_to_png.py:118

Finding

Predictable Filenames Are Used in the Shared System Temporary Directory

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents a broad meta-skill for creating a complete branded asset suite from analysis through design, conversion, packaging, and optional guidelines/extensions. The actual code chunk is much narrower: a single Python script for rendering existing SVG files into PNGs, generating multiple icon/logo sizes, creating favicon.ico, extracting PNGs from ICO, and batch-processing known directories. This aligns only with part of the declared BA3 conversion pipeline. Comments mention other pipeline stages or directories, but no code here performs those stages. Therefore the description materially overstates the behavior of the supplied code chunk and its primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个“生成型”品牌资产端到端系统，核心职责应是产出Logo、VI系统、SVG/PNG/ICO和HTML交付物。实际代码则是“校验型”工具，其主功能是验证现有资产目录是否完整、HTML引用是否正确、PNG尺寸标注是否匹配、ICO结构是否有效、是否存在重复PNG，以及文件总数是否符合预期。虽然这些检查与品牌资产交付流程相关，可视为辅助质量保障，但它们不能代表所声明的主要生成能力。代码的主目的与声明的主目的存在实质性偏差，因此应判定为描述与行为不匹配。

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/exemplars/BA4-整合交付域范本.md (reported line 27)May include surrounding context.

md

<style>/* 见下方CSS */</style>
</head>
<body>
  <!-- 1. Hero区：Logo + 公司名 + 副标题 -->
  <!-- 2. 核心标志：横版/竖版/纯图标（SVG+PNG双格式对照卡片）+ 纯图标多尺寸(6 PNG展开) + favicon.ico多尺寸(4 PNG展开) -->
  <!-- 3. 商标注册：黑白稿 + 彩色稿（6个卡片） -->
  <!-- 4. 数字化应用：App/头像/水印/黑白/反白（5个卡片） -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/exemplars/BA4-整合交付域范本.md (reported line 27)May include surrounding context.

md

<style>/* 见下方CSS */</style>
</head>
<body>
  <!-- 1. Hero区:Logo + 公司名 + 副标题 -->
  <!-- 2. 核心标志:横版/竖版/纯图标(SVG+PNG双格式对照卡片)+ 纯图标多尺寸(6 PNG展开) + favicon.ico多尺寸(4 PNG展开) -->
  <!-- 3. 商标注册:黑白稿 + 彩色稿(6个卡片) -->
  <!-- 4. 数字化应用:App/头像/水印/黑白/反白(5个卡片) -->

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill explicitly instructs use of environment variables, file reads/writes, and shell-executed scripts, but it declares no tool or permission scope. That creates an authorization gap: a host may expose broader capabilities than users expect, enabling filesystem modification, command execution, or environment-dependent behavior without transparent gating.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger list contains broad phrases such as brand asset, VI system, and meta-skill-system, which can cause the skill to activate for ordinary design or business requests outside the user's intent. In a skill that can read/write files and invoke scripts, overbroad activation increases the chance of unintended execution paths, file modifications, or confusing tool selection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly collects personal details such as name, phone, email, website, and address, then propagates that real information into many generated SVG/PNG/HTML assets. This creates avoidable privacy and data-handling risk because sensitive business or personal data may be replicated across dozens of files without consent prompts, minimization, masking options, or retention guidance.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is designed to gather real personal and company information and then batch-replace it throughout generated branding assets. In context, this increases exposure because the information is intentionally duplicated into many artifacts, making accidental disclosure, stale data propagation, and mishandling more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file is natural-language guidance, and it presents the skill requirements entirely in Chinese as prescriptive instructions. Under the language/locale policy rule, forcing a specific language without user opt-in or a documented regional justification is a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all user-facing instructions, headings, and workflow guidance exclusively in Chinese. Under the policy rule for language or locale constraints, this is a natural-language policy issue because the file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-speaking or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown exemplar is written entirely in Chinese and presents the skill content as the default operating format for the domain template. Under the policy rule, forcing a specific language without an explicit user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document explicitly instructs users to delete existing PNG files with rm before re-rendering, but provides no safety warning, scoping guidance, or safeguards. In an agent skill context, operational guidance can be copied or automated, so destructive commands without cautions increase the risk of accidental data loss, especially if run from the wrong directory or with broadened globs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML template sets lang="zh-CN", and the surrounding file content is written entirely in Chinese as a default template. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The HTML template explicitly sets lang="zh-CN", and the surrounding content consistently prescribes Chinese-language brand materials. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy concern unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The key points prescribe Microsoft YaHei / PingFang SC for Chinese and Arial / Helvetica for English as default requirements, which imposes a locale-specific typography policy. The document does not state that this skill is limited to a China-specific branding context or allow alternative locale-appropriate font selections.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This is a natural-language policy issue because the file forces a specific language for usage instructions and operational messages, which may prevent users from understanding warnings or correct usage unless they already read Chinese. The file does not offer an opt-in, alternative locale, or justification that it is intended only for a Chinese-language environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_svg_to_png.py (reported line 132)May include surrounding context.

python

"--default-background-color=00000000", url
        ]
        try:
            subprocess.run(cmd, capture_output=True, timeout=timeout)
        except subprocess.TimeoutExpired:
            continue
        if os.path.exists(png_path) and os.path.getsize(png_path) > 0:

Tainted flow: 'cmd' from os.environ.get (line 125, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 86% confidence

Finding

The executable path comes from the EDGE environment variable and is executed without validation. In any environment where an attacker can influence process environment variables or task configuration, this can cause the script to run an attacker-controlled binary, resulting in arbitrary code execution under the script's privileges.

Content

Scanner excerpt · scripts/render_svg_to_png.py (reported line 132)May include surrounding context.

python

"--default-background-color=00000000", url
        ]
        try:
            subprocess.run(cmd, capture_output=True, timeout=timeout)
        except subprocess.TimeoutExpired:
            continue
        if os.path.exists(png_path) and os.path.getsize(png_path) > 0:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_svg_to_png.py (reported line 515)May include surrounding context.

python

"--default-background-color=00000000",
                        "file:///" + html_path.replace("\\", "/")
                    ]
                    subprocess.run(cmd, capture_output=True, timeout=t)
                    if os.path.exists(out_png) and os.path.getsize(out_png) > 0:
                        print("    OK: %s (%dx%d, %dB)" % (
                            fname, render_w, render_h, os.path.getsize(out_png)))

Tainted flow: 'cmd' from os.environ.get (line 508, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 86% confidence

Finding

This is the same underlying issue in the batch-render path: the command ultimately executes a browser binary selected from an untrusted environment variable. If an attacker can set EDGE to a rogue executable, the batch mode becomes a convenient code-execution primitive across many files.

Content

Scanner excerpt · scripts/render_svg_to_png.py (reported line 515)May include surrounding context.

python

"--default-background-color=00000000",
                        "file:///" + html_path.replace("\\", "/")
                    ]
                    subprocess.run(cmd, capture_output=True, timeout=t)
                    if os.path.exists(out_png) and os.path.getsize(out_png) > 0:
                        print("    OK: %s (%dx%d, %dB)" % (
                            fname, render_w, render_h, os.path.getsize(out_png)))

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The workflow includes deleting auxiliary files and copying deliverables to Downloads as part of automated cleanup and packaging, but does not require an explicit user approval step. While this is operational rather than overtly malicious, unattended deletion or file placement can cause data loss, overwrite confusion, or unexpected exposure of generated assets in shared environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file provides reusable SVG templates that prominently include placeholders for phone numbers, email addresses, names, and company websites, but it does not warn users that the generated assets may expose personal or contact information publicly. Under the markdown-specific warning criteria, descriptions that affect privacy should disclose this risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The email signature section explicitly instructs inclusion of name, phone number, email address, and company website in an outward-facing signature block, yet no warning advises users to avoid unnecessary personal data exposure. This is a privacy-relevant behavior in a markdown skill/template description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.