Back to skill

Security audit

Animation Shader

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only toon shader reference skill with no evidence of unsafe execution, persistence, credential use, or hidden behavior.

Install this if you want an agent to use bundled toon-shader reference material. Be aware that some detailed references are Chinese or bilingual, so users who need English-only documentation may need translation, and the workflow may cause the agent to read several included reference files before answering.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document is written primarily in Chinese, including headings and explanatory text, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. This can violate language/locale policy when a skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The entire skill file is written in Chinese, with only limited English headings, and does not indicate that language selection is optional. This can violate a language/locale policy when users are not given a choice or told the skill is specifically intended for a Chinese-speaking audience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

SQP-3 applies to all file types and covers language or locale policy violations. The title immediately presents bilingual content and the rest of the document is predominantly Chinese, but the file does not state that the skill or documentation is region-specific or that users may choose their preferred language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

This markdown file is almost entirely written in Chinese, including headings and explanatory text, but it does not state that the skill is region-specific or provide an opt-in for language/locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file is primarily written in Chinese while also embedding English shader terms, and it does not indicate that the user can choose another language or that the content is intentionally region-specific. Under the policy rule for language or locale constraints, forcing a specific language without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file content is written primarily in Chinese, including headings and explanatory text, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown content is written entirely in Chinese, with only limited English labels, and does not indicate that another language is available or that Chinese is a required locale. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file is written entirely in Chinese, including the substantive operational description, without indicating that another language is available or that Chinese is a region-specific requirement. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

This markdown file presents its instructional content almost entirely in Chinese, with only limited English glosses. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can be a natural-language policy violation when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file is natural-language content, so language policy checks apply. The title and nearly all explanatory text are in Chinese with English only as secondary labels, and the file does not state that language selection is optional or user-configurable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains instructional natural language exclusively in Chinese, including headings and explanatory content, without indicating that the user can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The heading mixes English and Simplified Chinese, and the body is primarily written in Chinese, which can impose a language expectation on users without explicit opt-in. Under the policy rule, forcing or assuming a specific language without user choice can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.