Security audit

Ai Image To Code

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it claims: turn user-provided UI screenshots into code, with the main caution that screenshots should be redacted before use.

Installers should treat this as a normal screenshot-to-code helper. Before using it, redact API keys, customer data, private dashboards, unreleased product designs, or other confidential information from screenshots because the skill is designed to analyze the image content with a vision model.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs users to paste screenshots for analysis but provides no warning that UI images may contain sensitive information such as API keys, personal data, internal dashboards, or proprietary designs. In this context, omission of a privacy notice increases the chance that users will submit confidential material to the model or platform without understanding the exposure risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python test file contains a natural-language policy constraint by requiring the presence of README_zh.md. That effectively enforces a specific locale/language artifact at the repository level, and the file provides no user choice or justification for the Chinese-language requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file explicitly says to 'Keep SKILL.md body in English,' which is a natural-language locale constraint. Under the policy, forcing a specific language without opt-in or a clearly documented justification is a reportable violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The line states 'SKILL.md body must be in English; reference docs in English,' which enforces a specific language policy. The file does not provide user choice or explain why this restriction is necessary, so it conflicts with the stated natural-language policy criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 62% confidence
Finding: The file presents an alternate Chinese README, but there is no clear statement about whether the skill itself supports multiple languages or whether outputs/default interactions are language-neutral. This is a low-confidence policy concern because language handling is not explicitly documented, and users are not told whether they can choose their preferred language or locale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file-level documentation says this is an auto-generated test suite for the 'user-provides-screenshot' skill, establishing the intended target of the tests. However, the runtime banner printed by _main() announces 'TEST SUITE -- skill-factory', which contradicts that documented intent and suggests the code is identifying a different skill than the one described.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.