Security audit

feifei

Security checks for vulnerabilities and agentic risk

Overview

This skill is a p5.js generative-art helper with disclosed templates and no evidence of credential access, persistence, destructive behavior, or exfiltration.

Installers should be aware that outputs are steered toward an Anthropic-branded viewer template and may load p5.js and fonts from external CDNs. This looks safe from a security standpoint, but users who need neutral branding or fully offline artifacts should modify the template or choose a different skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The invocation scope is broad enough to trigger on generic art or code requests, not just the intended niche of seeded p5.js generative art. Overbroad activation can cause the skill to take over unrelated user tasks, inject unnecessary constraints, or steer outputs toward this template-driven workflow when it is not appropriate.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The file gives conflicting output requirements: first it says to produce separate .html and .js files, then later mandates a single self-contained HTML artifact with inline JavaScript. Ambiguous build instructions are dangerous because they increase the chance the agent will produce inconsistent artifacts, omit controls, or mishandle code separation in ways that bypass review or break expected security and packaging assumptions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill claims to create original algorithmic art, yet it instructs the agent to copy a branded HTML template verbatim and preserve fixed branded sections. This creates a provenance and policy risk: generated outputs may inherit protected branding or non-user-requested product identity, undermining originality claims and potentially causing unauthorized brand use in downstream artifacts.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill forces Anthropic branding, exact UI structure, and visual identity into every produced artifact regardless of user intent. That is risky because it can create deceptive affiliation, unauthorized brand propagation, and hidden policy steering inside user deliverables, especially when the user asked only for original art code rather than branded collateral.

Static analysis

No suspicious patterns detected.