Security audit

Convert Any Screenshot

Security checks for vulnerabilities and agentic risk

Overview

This skill does not show malware behavior, but its advertised screenshot-to-UI purpose conflicts with its main instructions and it makes unclear credential and write-mode claims.

Review before installing. The main risk is not malware; it is that the skill is mislabeled and under-documented. Ask the publisher to align SKILL.md with the screenshot-to-UI purpose, remove or justify the API_KEY/sensitive-credential claim, and document exactly what write mode does before relying on it.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill advertises screenshot-to-UI conversion, but its body documents a generic structured-data transformer workflow instead. This mismatch can cause an agent to invoke the skill in inappropriate contexts, mishandle image inputs, and produce outputs unrelated to the user's request, undermining trust and enabling unsafe automation decisions based on false capability claims.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The manifest and documentation consistently describe a generic format-conversion tool rather than the declared screenshot conversion skill. In an agent ecosystem, this kind of semantic deception or severe misconfiguration is dangerous because capability selection may route sensitive or irrelevant inputs to the wrong skill, leading to data exposure, incorrect outputs, or broken task chains.

Intent-Code Divergence

High

Confidence: 96% confidence
Finding: The internal documentation explicitly instructs text/schema conversion workflows that contradict the skill's claimed screenshot-processing intent. This increases operational risk because downstream agents or users may trust the top-level description while the embedded instructions drive behavior toward unrelated parsing and transformation tasks.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The file defines a working _main() that runs the test suite, but later redefines _main() to call an undefined _run_unit_tests(). When executed directly, Python uses the later definition, causing the documented entrypoint to fail and making the test suite non-runnable. In a security or quality gate context, this can disable intended validation and allow noncompliant or risky skill content to pass without being tested.

Missing User Warnings

Medium

Confidence: 71% confidence
Finding: The README advertises a write mode with an input file but gives no warning about what may be modified, where output is written, or whether existing data can be overwritten. In an agent skill context, unclear write semantics can lead to unintended file modification or destructive actions if users or automation invoke the mode assuming it is safe.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The activation condition is broad enough to match many unrelated conversion requests, which raises the chance of accidental invocation. In combination with the skill's description/behavior mismatch, overbroad triggering makes the skill more dangerous because it can hijack tasks outside its actual capabilities and return misleading results.

Static analysis

No suspicious patterns detected.