Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because the skill is not clearly harmful, but its advertised screenshot purpose conflicts with its main instructions and supporting docs.
Install only after reviewing the mismatch. Do not provide API keys or sensitive screenshots unless you are comfortable with the unclear scope, and expect the skill to behave more like a confused template/generated package than a polished screenshot-to-code tool.
The manifest claims the skill converts UI screenshots into React or HTML/CSS prompts, but the body describes a generic structured-data converter for text formats like JSON, CSV, XML, and code. This mismatch can cause the agent to invoke the wrong skill on inappropriate inputs, leading to unsafe data handling, user confusion, and potentially unintended processing of sensitive content.
The manifest claims the skill converts UI screenshots into React or HTML/CSS prompts, but the body describes a generic structured-data converter for text formats like JSON, CSV, XML, and code. This mismatch can cause the agent to invoke the wrong skill on inappropriate inputs, leading to unsafe data handling, user confusion, and potentially unintended processing of sensitive content.
The skill is advertised as screenshot-to-frontend-prompt conversion, yet its operational instructions define a generic data/schema transformation workflow. This semantic drift increases the chance of accidental invocation on unrelated content and can route sensitive screenshot tasks into a skill that is not designed with image-specific safety, privacy, or output constraints.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Include proper type definitions
- Handle basic state where needed (forms, toggles)
"""
return prompt.strip()
if __name__ == "__main__":
description = sys.stdin.read() if len(sys.argv) < 2 else open(sys.argv[1]).read()
This markdown file contains a natural-language policy constraint requiring contributors to keep the SKILL.md body in English. Under the policy, forcing a specific language without user opt-in or a clearly justified region-specific need is a violation.
The file explicitly states that the SKILL.md body and reference docs must be in English. This is a natural-language locale policy restriction, and no user choice or justification is provided in the document.
This markdown file is in scope for vague-trigger review, and the usage text says only "When triggered: [trigger condition]." without any actual trigger phrase, scope, or exclusion criteria. That makes it unclear when the skill should activate versus not activate, increasing the risk of unintended invocation.
For markdown files, warnings should be present when described behavior may affect user data or system integrity. The usage example includes a "--mode write" operation with an input file, but the README provides no user-facing warning about what will be written, whether files may be modified, or any precautions before running it.
This markdown file includes a generic placeholder "[trigger condition]" instead of concrete trigger phrases or activation constraints. Without specificity or exclusion conditions, it is unclear when the skill should activate, which can lead to unintended invocation.
The documentation says this skill converts UI screenshots into a clean React or HTML/CSS implementation prompt, but the usage examples present generic '--mode read' and '--mode write' operations with JSON input. That actively suggests a different read/write data-processing tool behavior rather than a screenshot-conversion skill, creating intent confusion in the documentation.
Without declared permissions the skill's intent is opaque and cannot be validated.
The frontmatter presents one intent while the body instructs a different transformation behavior. In agent systems, these declarative fields often drive selection and trust decisions, so misleading metadata can cause misrouting and processing of data under false assumptions about what the skill will do.
The activation description is broad and underspecified, which can cause the orchestrator to trigger the skill in contexts beyond its actual competence. Over-broad invocation increases the risk of mishandling user data, especially when the skill's true behavior is already inconsistent with its advertised purpose.
A skill positioned for screenshot handling may receive images containing credentials, personal data, internal dashboards, or other sensitive information, yet the description provides no privacy warning or handling guidance. This omission is risky because users and agents may pass sensitive screenshots without being prompted to sanitize or minimize exposure.
This code contains a natural-language policy issue because it requires the presence of README_zh.md, which imposes a specific locale/language expectation. There is no accompanying justification that the skill is region-specific, nor any indication that language choice is optional.
The file defines _main twice, and the second definition replaces the earlier real test runner with one that calls _run_unit_tests(), which is undefined in this file. Because the main block invokes _main(), executing the test suite will crash instead of running the documented checks, creating a denial-of-service against validation and potentially allowing broken or noncompliant skills to slip through if maintainers assume the tests are functional.
Policy findings in this category apply to all file types and include language or locale constraints. While linking a Chinese version is not inherently a violation, the documentation does not clarify whether the skill supports multiple languages by user choice or whether any language is required by default.
The file presents the skill documentation entirely in Chinese while only linking to an English file, without stating that language is user-selectable or that this locale is required for a region-specific purpose. This can be a language/locale policy concern if the skill experience is effectively constrained by default.
The configuration table states that an 'API_KEY' is required for a service, but the rest of the documentation frames the skill as a screenshot-to-implementation-prompt converter without explaining any external service dependency. This creates a documentation-level divergence in stated intent and operational expectations.