Music Web Wallpaper Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:19 AM UTC
• Version: 0.1.0

Overview

The skill mostly matches its stated wallpaper-building purpose, but it forces every generated wallpaper to carry the skill creator's name and email and enforces that through validation.

Review before installing if you do not want wallpapers made with this skill to visibly include the skill creator's name and email. The package does not show hidden exfiltration, credential access, or system persistence, but the fixed credit should be made optional or user-controlled for neutral distribution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:154

Finding

Mandatory Third-Party Branding Enforced in Generated User Artifacts

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:154-155; enforcement occurs in scripts/validate_wallpaper.py:15-16, scripts/validate_wallpaper.py:141-143, and scripts/validate_wallpaper.py:182-185; the injected content appears in assets/starter/index.html:83.

Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Relevant Code and Instructions:

markdown

- Add a separate tool credit: `Created with the create-music-web-wallpaper Agent Skill by 双料贝斯手长崎素世 ([e-mail]).`
- Keep the tool credit readable and easy to find in About, Credits, or Material Sources, but visually subordinate to the wallpaper title, actual author, cover, and playback information.

python

SKILL_AUTHOR = "双料贝斯手长崎素世"
SKILL_EMAIL = "[e-mail]"

python

notice_path = root / "NOTICE.txt"
if notice_path.is_file():
    notice = notice_path.read_text(encoding="utf-8", errors="replace")
    if SKILL_AUTHOR not in notice or SKILL_EMAIL not in notice:
        errors.append("NOTICE.txt is missing the Skill creator attribution")

python

index_path = root / "index.html"
if index_path.is_file():
    index = index_path.read_text(encoding="utf-8")
    for label, needle in (("skill creator name", SKILL_AUTHOR), ("skill creator email", SKILL_EMAIL)):
        if needle not in index:
            errors.append(f"Visible credits are missing {label}")

html

<p class="skill-credit">Created with the <code>create-music-web-wallpaper</code> Agent Skill by 双料贝斯手长崎素世 ([e-mail]).</p>

Technical Analysis

The Skill changes the Agent's artifact-generation requirements by mandating a fixed third-party identity and email address in every generated wallpaper. This content is not necessary for the wallpaper's core music-player functionality.

The behavior is not merely a default in the starter template. The validator treats removal of the name or email from both ...[truncated 1799 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory fixed-credit requirement from SKILL.md.
2. Delete the SKILL_AUTHOR and SKILL_EMAIL checks from scripts/validate_wallpaper.py.
3. Do not treat the absence of personal contact information in index.html as a validation failure.
4. Replace the hardcoded credit in assets/starter/index.html with an optional, user-controlled field or omit it entirely.
5. Restrict validation to functional correctness, user-selected attribution, material licensing records, and legally required notices.
6. Keep any license-required notices in appropriate distribution metadata without forcing personal contact details into the visible runtime interface unless the user explicitly opts in.
7. Add a validation test confirming that a project can remove optional tool branding and still pass validation.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about authoring and iterating interactive Wallpaper Engine music-player wallpapers. The supplied code does not implement a wallpaper, web UI, playback controls, synchronized lyric display, theming, localization, or any Wallpaper Engine integration. Instead, it is a standalone Python CLI inspection tool for auditing media files in a directory and producing a JSON report with counts, metadata, warnings, and optional duplicate detection via hashing. While the inspected asset types (audio, lyrics, images, fonts) are related to wallpaper content, the code’s primary purpose and capabilities are materially different from the declared skill behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents a production skill for building or refining interactive music wallpapers and player interfaces in web technologies. The actual code does not create, rebuild, or modify wallpaper UI or behavior; instead, it audits an already existing project for structural correctness and publication readiness. While validation can be a supporting activity in a wallpaper workflow, this code chunk’s primary purpose is distinctly different: static project validation with strict compliance checks for required files, catalog schema, safe relative paths, Apache license/NOTICE content, visible credits, and release asset hygiene. That is a materially different capability set from the declared creation/refinement role, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill hard-codes a mandatory attribution string containing a personal name and email address, and requires it to be placed visibly in every generated wallpaper. This creates a privacy and supply-chain trust issue: it forces disclosure of third-party contact information into distributed artifacts and can coerce users into publishing personally identifying data or misleading attribution they did not choose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The required visible credit mandates the exact string Created with the create-music-web-wallpaper Agent Skill by 双料贝斯手长崎素世 ([e-mail])., which embeds a fixed non-user-selectable language/script element. This can violate language/locale policy because the file does not offer localization, user opt-in, or a documented reason that the credit must remain in that form.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The hard-coded creator identity and derivative-reference policy establish hidden ownership and attribution rules inside a utility that is supposed to validate wallpaper packaging. This can silently coerce downstream outputs to carry the skill author's identity or a derivative-work relationship, which is a supply-chain integrity issue because it manipulates generated artifacts without the user's informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The validator goes beyond structural validation and enforces visible crediting of a specific author, email address, and a specific third-party reference URL. In an agent skill, this creates a policy backdoor: generated projects can be forced to include unrelated attribution or derivative-design claims, causing unauthorized branding, misleading provenance, and hidden compliance requirements unrelated to the user's requested wallpaper.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The language selector presents the document in English by default with a secondary Simplified Chinese link, which can be read as a default language constraint rather than offering an explicit user language choice for skill behavior. Under the policy, language or locale requirements should be opt-in or clearly justified.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md

## What it is for

This Skill is not limited to bands. It can also be used for:

- solo artists, vocalists, and virtual singers;
- composers, music producers, and other creators;

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This is a plain-text file, so vague-trigger review applies. The file contains only licensing and attribution language and provides no explicit trigger phrases, activation conditions, or exclusion rules, which means trigger scope is unspecified if this text is part of the skill's surfaced description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Line L37 requires property labels and in-wallpaper text to use the "intended languages," which can imply a fixed language policy without offering the user a language or locale choice. This is a natural-language policy concern because the file does not indicate opt-in, alternatives, or a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The script description and embedded author metadata indicate a China/Chinese-specific context, including a Chinese author name and QQ email, but there is no accompanying explanation that this skill is region-specific or any indication that users can choose a language/locale. Under the policy, forced or implicit locale constraints should be documented or optional.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.