Chinese Image Gen

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:06 AM UTC
• Version: 1.0.0

Overview

This skill does what it says, but it renders HTML in Chromium with the browser sandbox disabled, which is risky enough to require review before use.

Install only if you are comfortable running a local Playwright/Chromium renderer. Use trusted or agent-generated HTML, prefer a pinned Playwright version, and run rendering in a disposable or restricted environment if inputs may be untrusted; also expect outbound requests to Google Fonts unless you replace the font with a local asset.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/render.py:13
• Finding: Chromium Sandbox Disabled While Rendering Untrusted HTML## Vulnerability Details **File Location**: `scripts/render.py:13` **Vulnerability Type**: Browser sandbox disabled for attacker-controlled active content **Risk Level**: High **Vulnerable Code**: ```python browser = p.chromium.launch(args=['--no-sandbox']) ``` ### Technical Analysis The renderer accepts the contents of a user-selected HTML file and loads them into Chromium using `page.set_content()`. The HTML may contain JavaScript and references to remote resources. Chromium is launched with `--no-sandbox`, which disables an important operating-system-level security boundary intended to contain compromised browser processes. Web-origin controls may still restrict ordinary page behavior, but they are not a replacement for Chromium's process sandbox. If malicious HTML exploits a vulnerability in Chromium or one of its rendering components, disabling the sandbox allows the resulting code to execute directly with the privileges of the account running `render.py`. ### Attack Path 1. An attacker creates or modifies an HTML input file containing malicious active content. 2. The victim invokes `render.py` with that file as its input. 3. The script starts Chromium with `--no-sandbox`. 4. Chromium parses the content, executes JavaScript, and loads any referenced remote resources. 5. Malicious content exploits a compatible Chromium or rendering-engine vulnerability. 6. Because the process sandbox is disabled, successful exploit code runs with the renderer user's host permissions rather than being confined by the normal Chromium sandbox. Exploitation beyond normal browser behavior requires a suitable browser vulnerability, but the configuration materially increases the impact of such a vulnerability. ### Impact Assessment A successful exploit could obtain the privileges of the operating-system user running the renderer. Depending on that account's permissions, this could permit access to readable files, modification of writ ...[truncated 278 chars]
• Remediation: ## Remediation Suggestions - Remove the `--no-sandbox` argument and run Chromium with its standard sandbox enabled: ```python browser = p.chromium.launch() ``` - Ensure the host supports Chromium sandboxing and run the renderer as a dedicated, unprivileged user. - If sandboxing cannot be enabled, perform rendering inside a disposable, hardened container or virtual machine with: - No host filesystem mounts except narrowly scoped input and output locations. - A read-only root filesystem. - Dropped Linux capabilities. - No privilege escalation. - CPU, memory, process, and execution-time limits. - Restricted or disabled outbound network access. - Treat all input HTML as untrusted. Disable JavaScript when it is not required and intercept network requests to allow only explicitly approved font or asset origins. - Keep Playwright and its corresponding Chromium build patched through a controlled update process.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Playwright and Chromium Installation Instructions## Vulnerability Details **File Location**: `SKILL.md:18-24` **Vulnerability Type**: Unpinned third-party runtime and browser dependencies **Risk Level**: Medium **Vulnerable Code**: ```bash # Install Playwright (Python) pip install playwright # Install Chromium browser (required once) playwright install chromium ``` ### Technical Analysis The documented installation procedure resolves the current Playwright release without a version constraint, lockfile, or package hash. The subsequent command downloads the Chromium build selected by whichever Playwright version was resolved. Consequently, two installations performed at different times can obtain different executable artifacts without any project review or source change. A compromised package release, package index, dependency-resolution configuration, or newly introduced vulnerable release could therefore affect users following these instructions. No evidence was found that Playwright or Chromium is intentionally malicious. The finding concerns the absence of reproducible version and integrity controls rather than a confirmed compromise of either dependency. ### Attack Path 1. An attacker compromises an applicable dependency distribution channel, package-index configuration, upstream release, or resolved package artifact. 2. A user follows the documented `pip install playwright` command. 3. Because no version or integrity hash is enforced, the installer resolves and installs the affected artifact. 4. The package can execute through installation-related behavior, imports, or subsequent invocation. 5. `playwright install chromium` then retrieves the browser revision selected by that uncontrolled Playwright version. 6. The compromised or vulnerable component executes with the permissions of the installing or rendering user. This path depends on compromise or unsafe resolution in the dependency supply chain; the repository itself does not contain a remote payloa ...[truncated 502 chars]
• Remediation: ## Remediation Suggestions - Pin Playwright to a reviewed version compatible with a specific Chromium revision. - Maintain dependencies in a lockfile generated through a controlled dependency-management process. - Require cryptographic hashes for Python packages, such as with a hash-locked requirements file and `pip install --require-hashes`. - Use an explicitly trusted Python package index and disable unintended fallback indexes. - Build deployment artifacts in a controlled environment and verify downloaded browser artifacts before distribution. - Run dependency installation as an unprivileged user rather than with administrator or root permissions. - Automate vulnerability scanning and update pinned versions through reviewed changes instead of resolving mutable latest releases during deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger list includes broad phrases like '生成图片', '做配图', 'generate image', and 'make infographic', which can match many ordinary user requests and cause the skill to activate unexpectedly. Overbroad activation increases the chance that the agent performs file creation, browser rendering, and outbound font fetches in contexts where the user did not intend this specific skill to run.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The skill depends on loading `https://fonts.googleapis.com` and related font assets at render time, but the user-facing description does not clearly disclose that external network requests will occur. This matters because rendered content may be processed in environments with privacy, egress-control, or offline constraints, and silent network dependency can lead to data exposure through request metadata or policy violations.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The module docstring presents the skill name and usage only in Chinese, and the script's user-facing messaging is likewise Chinese-only. This imposes a specific language on users without any opt-in or documented locale justification, which matches the language/locale policy violation criteria.

Static analysis

No suspicious patterns detected.