Versioned security assessment
Report ID: SA-7E437D5B
7/5/2026, 2:29:35 PM
guizang-social-card-skill security assessment v2
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- guizang-social-card-skill
- Version
- v2
- Maintainer
- op7418
- Coverage
- 37 Files scanned · 9,871 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
Medium
4 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
AI review found no prompt-injection attempt or malware intent in the skill prose. Most static hits are false positives from Markdown, CSS relative asset paths, template literals, license text, WebP assets, and checksum strings. Confirmed risks are intentional execution and network surfaces: rendering tools, media helpers, optional web asset fetching, remote template resources, Mapbox token-bearing URLs, and temporary files.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
37 Files scanned · 9,871 Lines analyzed
34 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 27 evidence locations
Filesystem access
May read or write local files.
Observed in 41 evidence locations
Env variables
May read values from the process environment.
Not recorded by this audit
External commands
May invoke commands or programs outside the Skill.
Observed in 125 evidence locations
Capability review items (30)
High
Python subprocess.run
return subprocess.run(cmd, check=True, text=True, capture_output=True)
The helper executes ffprobe and ffmpeg through subprocess.run against caller-provided video paths. Argument arrays reduce shell-injection risk, but this is real external command execution on untrusted media.
Medium
Hardcoded URL
<script src="https://unpkg.com/lucide@latest/dist/umd/lucide.min.js"></script>
The Swiss seed template loads lucide JavaScript from unpkg at render time. This is intended icon support, but it executes third-party script in the render page.
Medium
Temp directory access
UV_CACHE_DIR=/private/tmp/uv-cache \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
UV_TOOL_DIR=/private/tmp/uv-tools \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
UV_CACHE_DIR=/private/tmp/uv-cache \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
UV_TOOL_DIR=/private/tmp/uv-tools \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
mkdir -p /private/tmp/mimo-check
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
-frames:v 1 /private/tmp/mimo-check/process_contact.jpg
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
-frames:v 1 /private/tmp/mimo-check/result_contact.jpg
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
UV_CACHE_DIR=/private/tmp/uv-cache \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Temp directory access
UV_TOOL_DIR=/private/tmp/uv-tools \
The Live Photo documentation tells agents to write uv caches or contact-sheet outputs under /private/tmp. This is expected operational guidance, but it creates files outside the task directory.
Medium
Hardcoded URL
https://api.mapbox.com/styles/v1/mapbox/light-v11/static/
The map recipe uses Mapbox Static URLs and may place MAPBOX_ACCESS_TOKEN in an image URL. This is intended map functionality, but it can disclose tokens and makes third-party requests.
Medium
Hardcoded URL
<img src="https://api.mapbox.com/styles/v1/mapbox/light-v11/static/.../1200x675@2x?access_token=..."
The map recipe uses Mapbox Static URLs and may place MAPBOX_ACCESS_TOKEN in an image URL. This is intended map functionality, but it can disclose tokens and makes third-party requests.
Medium
Ruby/shell backtick execution
- Use Playwright or a browser screenshot tool to export each `.poster` or `.cover` node.
The workflow tells agents to use Playwright or browser screenshot tooling to render posters. Browser automation can execute task HTML and remote page assets, so this is a real execution surface.
Medium
Ruby/shell backtick execution
- Keep `node validate-social-deck.mjs <task-dir>` available for auto-check passes. It checks overflo
The skill instructs agents to run node validate-social-deck.mjs against task folders. It is legitimate validation, but it invokes local tooling over generated HTML.
Medium
Ruby/shell backtick execution
- Package `JPG + MOV` into `.pvt` with `makelive`; AirDrop the `.pvt` as one item for iPhone tests.
The Live Photo branch instructs use of makelive to package JPG/MOV assets. This invokes external packaging code on user media, so it is real tool execution.
Medium
Ruby/shell backtick execution
- Use WebFetch or `curl` to download the image into the task folder's `assets/` directory.
The skill instructs agents to use WebFetch or curl to download external images into a task assets directory. The download is user-directed, but it expands network and file-write surface.
Medium
Ruby/shell backtick execution
4. If the user says "你查吧" / "auto-check" / "yes" — only then run `node validate-social-deck.mjs <tas
The delivery workflow instructs agents to run node validate-social-deck.mjs when the user asks for auto-check. This is expected, but it is still local command execution.
Medium
Hardcoded URL
1. **Unsplash** — `https://unsplash.com/s/photos/<keyword>`. Strong for outdoor / lifestyle / atmosp
The skill explicitly recommends third-party image-source sites for web-sourced assets. This user-directed feature still causes external network requests and imports unverified media.
Medium
Hardcoded URL
2. **Pexels** — `https://www.pexels.com/search/<keyword>/` or `https://www.pexels.com/zh-cn/search/<
The skill explicitly recommends third-party image-source sites for web-sourced assets. This user-directed feature still causes external network requests and imports unverified media.
Medium
Hardcoded URL
3. **Flickr CC-licensed pool** — `https://www.flickr.com/search/?text=<keyword>&license=2%2C3%2C4%2C
The skill explicitly recommends third-party image-source sites for web-sourced assets. This user-directed feature still causes external network requests and imports unverified media.
Medium
Hardcoded URL
4. **Wallhaven** — `https://wallhaven.cc/search?q=<keyword>`. Strong for game / anime / wallpaper th
The skill explicitly recommends third-party image-source sites for web-sourced assets. This user-directed feature still causes external network requests and imports unverified media.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Hardcoded URL
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Noto+Serif+SC:wght@400;500;700
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.googleapis.com">
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Hardcoded URL
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Hardcoded URL
<link rel="stylesheet" href="https://fonts.googleapis.com/css2?family=Inter:wght@200;300;400;500;600
The seed template loads Google Fonts from remote origins when rendered. This is intended styling behavior, but it creates outbound requests and font supply-chain exposure.
Low
Node.js fs stat operations
if (fs.statSync(abs).isDirectory()) {
The validator probes caller-supplied paths with fs.statSync/existsSync before opening task HTML. Scope is narrow, but it is real local filesystem access.
Low
Node.js fs stat operations
if (!fs.existsSync(htmlPath)) {
The validator probes caller-supplied paths with fs.statSync/existsSync before opening task HTML. Scope is narrow, but it is real local filesystem access.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (4)
RISK-001 Medium
Optional Web Asset Intake From Third-Party Sites
The skill directs agents to fetch images from Unsplash, Pexels, Flickr, Wallhaven, or direct web search, then save them locally and disclose provenance after fetching. This creates network exposure and imports untrusted media into generated task folders.
The workflow explicitly names external sources and tells agents to use WebFetch or curl to download assets. It is user-facing functionality, but it is a real third-party intake path.
RISK-002 Medium
Local Browser Rendering Executes Task HTML
The validator launches Chromium and opens a file URL for task HTML. Generated or user-modified task HTML can load remote resources and execute page scripts during validation.
The script opens local HTML with Playwright, and the seed template includes remote font and script tags. This is expected for rendering, but it expands execution and network surface.
RISK-003 Medium
Untrusted Video Parsing Through FFmpeg Toolchain
The contact-sheet helper runs ffprobe and ffmpeg against caller-provided video paths. This is useful for Live Photo QA, but parsing untrusted media through external codecs has a known risk profile.
The helper builds ffprobe and ffmpeg command arrays from a user-provided video path. It avoids shell=True, but still processes arbitrary media with external binaries.
RISK-004 Medium
Mapbox Token Exposure In Static Map Examples
The map recipe shows Mapbox Static URLs with access_token in the image source. If copied into generated HTML or shared task files, a real token could be exposed.
The documentation explicitly requires MAPBOX_ACCESS_TOKEN and shows it embedded in an img URL. The example is legitimate, but token-bearing URLs need handling guidance.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighVideo helpers execute ffmpeg and ffprobe on user-provided media.Document prerequisites, restrict inputs to task folders, and warn users not to process untrusted videos in sensitive workspaces.
- FIX-002MediumThird-party resources load during template rendering.Bundle fonts and icon scripts locally, pin versions, or add integrity checks before rendering untrusted task HTML.
- FIX-003MediumWeb-sourced asset workflow imports unverified media.Require explicit user consent for each source, validate file type and size, and keep provenance in task-local files.
- FIX-004MediumLive Photo documentation writes caches and checks under /private/tmp.Prefer task-local cache and output directories, or clean temporary artifacts after packaging.
- FIX-005MediumMapbox examples place access tokens in image URLs.Use restricted tokens, avoid committing generated HTML with tokens, and remove token-bearing URLs from shared artifacts.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Static false positives ignored (4)
High
Screen capture upload
/* Use for UI screenshots / web captures / code shots. Replaces .frame-img
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Screen capture upload
For UI screenshots / web captures / code shots, use `.frame-shot` (both seeds carry it). It defaults
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Screen capture upload
Before framing, decide what the actual screenshot subject is. If the source capture contains a float
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
Screen capture upload
When the user delivers a full-screen capture (1290×2796 iOS / 1080×2400 Android / 1920×1080 desktop)
Force-confirmed blocker/high static finding; AI dismissal overridden.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable