creating-coloring-books
Fail
Audited by Gen Agent Trust Hub on Oct 16, 2026
Risk Level: HIGHCREDENTIALS_UNSAFEDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill contains hardcoded credentials for the Piwigo asset gallery hosted at
media.delo.sh. Phase 6 explicitly includes a username (delorenj) and a cleartext password (Ittr5eesol) for authentication.\n- [DATA_EXFILTRATION]: The skill instructions and thescripts/coloring-convertscript both attempt to source credentials from a sensitive local file path:~/.config/zshyzsh/secrets.zsh. Accessing configuration files outside of the skill's own directory to harvest secrets is a high-risk behavior.\n- [INDIRECT_PROMPT_INJECTION]: The workflow involves searching Google Images (Phase 1) and capturing screenshots (Phase 2) which are then processed by a generative AI model (Phase 3). Malicious content embedded in the search results or image metadata could potentially influence the agent's behavior or the generated output.\n - Ingestion points: Google Images search results and captured thumbnails/screenshots (Phase 1 and 2) from
SKILL.md.\n - Boundary markers: None. The external content is directly passed to the conversion prompt.\n
- Capability inventory: Subprocess execution for image conversion and vectorization, file system writes to local directories, and network uploads to
fal.aiandmedia.delo.shacrossSKILL.mdandscripts/coloring-convert.\n - Sanitization: None. The skill relies on visual inspection (Phase 5) after the conversion has already occurred.\n- [DYNAMIC_EXECUTION]: The skill contains embedded Python code blocks in
SKILL.mdfor image cropping (using OpenCV) and PDF generation (using ReportLab) that are executed by the agent at runtime. While these perform the stated tasks, dynamic execution of generated scripts increases the attack surface.\n- [COMMAND_EXECUTION]: The skill frequently executes shell commands, includingmagickfor image conversion,zipfor packaging, and custom Python scripts within a virtual environment. It also uses theopenclawbrowser to automate interactions with multiple third-party storefronts like Etsy and Amazon KDP.
Recommendations
- AI detected serious security threats
Audit Metadata