screenshot-to-prototype

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This is a simple screenshot-to-prototype prompt skill with sloppy template documentation, but no evidence of hidden execution, data exfiltration, persistence, or destructive behavior.

Safe to install for normal use, but treat it as a lightweight prompt template. Share only screenshots you intend the agent to inspect, and be aware that the README appears auto-generated and contains inaccurate placeholder read/write/API-key guidance that should not be relied on.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose suggests a skill that converts UI screenshots into editable frontend prototype code. However, the code chunk only implements automated tests for skill/repository structure and content quality. It reads markdown and repo files, validates frontmatter and documentation sections, searches for secrets, and checks auxiliary files. These are materially different capabilities and an unrelated primary purpose. The file/resource access pattern is also inconsistent with the declared function, since it inspects local project files rather than handling user-provided screenshots.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- Do not make up facts or claim actions were taken that were not
- Do not hardcode API keys — use `os.getenv("API_KEY")` instead
- Do not store sensitive user data beyond the current session
- Do not exceed token budget without warning the user first
- Do not activate for off-topic requests — return a brief decline message

### Do

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger description is a placeholder and does not define when the skill should activate, creating ambiguity about scope and authority. Poorly defined activation conditions can cause an agent to invoke the skill in inappropriate contexts, potentially exposing screenshots, project files, or other sensitive data to processing the user did not intend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises generic read/write modes that do not align with the stated screenshot-to-prototype function, which can mislead users about the skill's actual behavior and operational scope. In an agent ecosystem, ambiguous or mismatched invocation patterns increase the risk of unintended file access or modification because users may run commands without understanding what data will be read or written.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README documents a write mode without warning that it may modify user data or files, which creates a safety and integrity risk. For a skill that turns screenshots into editable code, undocumented write behavior is more dangerous because users may assume generation is ephemeral while the tool could overwrite source files or create artifacts in the workspace.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This markdown file includes a trigger description field but leaves it as the placeholder "[trigger condition]" instead of specifying concrete phrases or constraints. That makes it unclear when the skill should activate versus not activate, which matches the vague-trigger category for markdown files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation for usage shows a generic '--mode read' and '--mode write --input ./data.json' workflow, which contradicts the manifest's stated purpose of converting a pasted UI screenshot into editable frontend prototype code. This is not merely incomplete documentation; it describes a different interaction model centered on generic data read/write operations rather than screenshot-based prototype generation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

- Do not make up facts or claim actions were taken that were not
- Do not hardcode API keys — use `os.getenv("API_KEY")` instead
- Do not store sensitive user data beyond the current session
- Do not exceed token budget without warning the user first
- Do not activate for off-topic requests — return a brief decline message

### Do

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file reads and validates SKILL.md, README.md, README_zh.md, CONTRIBUTING.md, .gitignore, tests/, and scripts/ structure. This broad project-auditing capability is not a direct requirement for generating frontend prototypes from screenshots.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says this skill is for turning a pasted UI screenshot into editable frontend prototype code, but this file implements a repository/metadata compliance test runner for SKILL.md, README, licensing, and test structure. These operations are not an obvious implementation detail of screenshot-to-code generation and indicate behavior outside the described skill purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The test walks files under its directory and scans their contents for secret-like patterns, reading repository material unrelated to the user-requested screenshot conversion task. Even though it is limited to the local skill tree, this creates unnecessary data exposure and broad file inspection behavior that could surface sensitive material during test execution or logs.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The test requires a specific locale artifact, README_zh.md, which imposes a language/locale expectation in project policy. The file does not indicate that this requirement is optional, user-selected, or justified as a region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The line explicitly says to keep the SKILL.md body in English, which is a natural-language locale constraint. Under the policy, forcing a specific language without opt-in can be a policy violation unless the constraint is clearly justified, and no justification or choice is provided here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This instruction imposes an English-only requirement on documentation content. The rule flags language-policy constraints when they are mandatory and not presented as an opt-in choice or clearly justified by a region- or compliance-specific need.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The file links to a Chinese version, but the documentation does not state how language is selected or whether users can choose their preferred language in the skill behavior. If the skill or its documentation defaults to a locale without explicit user choice, that can create a language-policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The top-level documentation says this file is a runnable auto-generated test suite, and the first _main implementation indeed runs the listed tests. However, a later redefinition of _main changes the actual runtime behavior to call _run_unit_tests(), contradicting the documented execution path and making the stated run instructions inaccurate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The test reads repository files and performs silent secret-pattern scanning without any disclosure to the operator. In contexts where tests may run on developer machines or imported third-party code, undisclosed file inspection increases privacy risk and can normalize unexpected access to local project contents.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.