Security audit
Security checks for vulnerabilities and agentic risk
This skill is not clearly malicious, but its advertised screenshot-to-prompt purpose does not match its main instructions, which describe generic data conversion instead.
Review this skill carefully before installing. It appears to be a low-capability package with no persistence or network behavior, but its documentation is inconsistent enough that users may not get the screenshot-to-prompt behavior they expect. It should be corrected to either truly document and implement screenshot-prompt generation or be renamed and scoped as a generic data-conversion skill.
A second, more severe description-behavior mismatch indicates the skill may perform repository/documentation validation, filesystem inspection, and secret scanning despite claiming to be a screenshot conversion skill. Hidden or undisclosed scanning behaviors are dangerous because they can lead to unauthorized inspection of local files and sensitive project contents under a misleading pretext.
A second, more severe description-behavior mismatch indicates the skill may perform repository/documentation validation, filesystem inspection, and secret scanning despite claiming to be a screenshot conversion skill. Hidden or undisclosed scanning behaviors are dangerous because they can lead to unauthorized inspection of local files and sensitive project contents under a misleading pretext.
The body of the skill clearly documents a generic structured-data transformation workflow rather than the declared screenshot-to-prompt behavior. This kind of semantic mismatch is dangerous in agent systems because routing, trust, and user consent depend on accurate skill descriptions; a misleading skill can be invoked on sensitive inputs outside user expectations.
The function directly incorporates attacker-controlled input (description[:200]) into the generated prompt without sanitization or structured extraction. In a skill whose purpose is to turn screenshots/descriptions into AI-generation prompts, this increases prompt-injection risk: a crafted description can steer downstream model behavior, override intended style constraints, or embed hidden instructions into the produced prompt.
style = description[:200]
prompt = f"""A clean {layout} UI design with {', '.join(elements[:5])} if elements else 'modern interface elements'}, {style}"""
return prompt
if __name__ == "__main__":
if len(sys.argv) < 2:
The file states 'Keep SKILL.md body in English,' which is a natural-language policy constraint forcing a specific language. This is reiterated later in the code standards, but no opt-in, alternative language path, or region-specific justification is provided.
The policy 'SKILL.md body must be in English; reference docs in English' imposes a language restriction in natural language. Under the stated policy criteria, forcing a specific language without user opt-in or clear justification is a violation.
Line L13 states "When triggered: [trigger condition]." without defining any actual trigger phrase or boundary. This makes it unclear when the skill should activate and increases the risk of unintended invocation due to missing specificity.
The usage section includes --mode write --input ./data.json at L40, which suggests data-writing behavior, but the README provides no user-facing warning about possible file or data modification. For markdown files, operations that could affect user data should be disclosed clearly.
Leaving the trigger condition as a placeholder makes activation criteria ambiguous, which is risky for agent-driven systems that rely on precise routing and capability descriptions. An imprecise trigger can cause the skill to be invoked in the wrong context, potentially processing unintended inputs or being chained into workflows it was not designed to handle.
The README presents generic read/write command examples that do not match the stated purpose of converting screenshots into image-generation prompts. This mismatch can mislead users or calling agents into invoking unsupported or unintended modes, increasing the chance of unsafe assumptions about file handling or data modification behavior.
Documenting a write mode without warning users about modification effects obscures the possibility of state changes or file output. In an agent context, unclear write semantics can lead to unintended overwrites, unsafe automation, or trust in behavior that has not been properly constrained or disclosed.
The skill documentation indicates behavior consistent with reading input from files, but it does not declare any explicit tool scope or permissions. In agent environments, undeclared file access increases the risk of over-broad capability use and makes it harder to enforce least privilege or review what data the skill may access.
The activation condition is broad enough that the skill could be selected for many unrelated user requests. Over-broad matching increases the chance of accidental invocation, especially when combined with misleading documentation and undeclared capabilities, which can expose data or trigger behavior the user did not intend.
The module and function documentation say this code generates a detailed prompt from a screenshot description, but the f-string on L39 contains the literal text "if elements else 'modern interface elements'" inside the generated prompt rather than implementing that conditional behavior. This means the output does not match the documented intent of producing a sensible UI-description prompt.