CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

26.6 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 2 flagged

Securityscore 76 · 2 findings

MEDIUMInstruction telling the agent not to ask for approvalSS-SKILL-INJECT-DONT-ASK-01 · Prompt injection · SkillBank/Common/baoyu-skills/baoyu-article-illustrator/references/workflow.md×2

MEDIUM — it fires on intent; the real damage depends on the host agent's own approval-gating.

Why it matters

The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.

The exact value spotted

excerptSkillBank/Common/baoyu-skills/baoyu-article-illustrator/references/workflow.md· markdown

84### 1.5 Load Preferences (EXTEND.md) ⛔ BLOCKING

86**CRITICAL**: If EXTEND.md not found, MUST complete first-time setup before ANY other questi

… (108 chars elided on L86)

88```bash

Occurrences

2 occurrences · first at L86, also L86

Show all 2 locations

Line

File

L86

SkillBank/Common/baoyu-skills/baoyu-article-illustrator/references/workflow.md

L86

SkillBank/Common/baoyu-skills/baoyu-article-illustrator/references/workflow.md

How to fix

Remove the approval-skipping instruction, or scope it narrowly to a specific safe, reversible action.

Delete blanket "don't ask / no need to confirm" directives from the skill.
If the skill is a genuine autonomous job, restrict the opt-out to a named non-destructive action rather than all actions.

Framework references

OWASPLLM01 ATLASAML.T0051

Trace & refs

ruleSS-SKILL-INJECT-DONT-ASK-01sha256010a4ca2189f0f8a…rubric 365aacaView on GitHub

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

SkillBank/Common/baoyu-skills/baoyu-article-illustrator/SKILL.md · 1 file

SkillBank/Common/baoyu-skills/baoyu-article-illustrator/SKILL.md5.3 KB · Markdown

id: "fef65f6d-860f-5683-bf61-d163a66c6d23"

name: baoyu-article-illustrator

description: Analyzes article structure, identifies positions requiring visual aids, generates illustrations with Type × Style two-dimension approach. Use when user asks to "illustrate article", "add images", "generate images for article", or "为文章配图".

Article Illustrator

Analyze articles, identify illustration positions, generate images with Type × Style consistency.

Two Dimensions

Dimension	Controls	Examples
Type	Information structure	infographic, scene, flowchart, comparison, framework, timeline
Style	Visual aesthetics	notion, warm, minimal, blueprint, watercolor, elegant

Combine freely: --type infographic --style blueprint

Types

Type	Best For
`infographic`	Data, metrics, technical
`scene`	Narratives, emotional
`flowchart`	Processes, workflows
`comparison`	Side-by-side, options
`framework`	Models, architecture
`timeline`	History, evolution

Styles

See references/styles.md for Core Styles, full gallery, and Type × Style compatibility.

Workflow

- [ ] Step 1: Pre-check (EXTEND.md, references, config)
- [ ] Step 2: Analyze content
- [ ] Step 3: Confirm settings (AskUserQuestion)
- [ ] Step 4: Generate outline
- [ ] Step 5: Generate images
- [ ] Step 6: Finalize

Step 1: Pre-check

1.5 Load Preferences (EXTEND.md) ⛔ BLOCKING

test -f .baoyu-skills/baoyu-article-illustrator/EXTEND.md && echo "project"
test -f "$HOME/.baoyu-skills/baoyu-article-illustrator/EXTEND.md" && echo "user"

Result	Action
Found	Read, parse, display summary
Not found	⛔ Run first-time-setup

Full procedures: references/workflow.md

Step 2: Analyze

Analysis	Output
Content type	Technical / Tutorial / Methodology / Narrative
Purpose	information / visualization / imagination
Core arguments	2-5 main points
Positions	Where illustrations add value

CRITICAL: Metaphors → visualize underlying concept, NOT literal image.

Full procedures: references/workflow.md

Step 3: Confirm Settings ⚠️

ONE AskUserQuestion, max 4 Qs. Q1-Q3 REQUIRED.

Q	Options
Q1: Type	[Recommended], infographic, scene, flowchart, comparison, framework, timeline, mixed
Q2: Density	minimal (1-2), balanced (3-5), per-section (Recommended), rich (6+)
Q3: Style	[Recommended], minimal-flat, sci-fi, hand-drawn, editorial, scene, Other
Q4: Language	When article language ≠ EXTEND.md setting

Full procedures: references/workflow.md

Step 4: Generate Outline

Save outline.md with frontmatter (type, density, style, image_count) and entries:

## Illustration 1
**Position**: [section/paragraph]
**Purpose**: [why]
**Visual Content**: [what]
**Filename**: 01-infographic-concept-name.png

Full template: references/workflow.md

Step 5: Generate Images

⛔ BLOCKING: Prompt files MUST be saved before ANY image generation.

For each illustration, create a prompt file per references/prompt-construction.md
Save to prompts/NN-{type}-{slug}.md with YAML frontmatter
Prompts MUST use type-specific templates with structured sections (ZONES / LABELS / COLORS / STYLE / ASPECT)
LABELS MUST include article-specific data: actual numbers, terms, metrics, quotes
DO NOT pass ad-hoc inline prompts to --prompt without saving prompt files first
Select generation skill, process references (direct/style/palette)
Apply watermark if EXTEND.md enabled
Generate from saved prompt files; retry once on failure

Full procedures: references/workflow.md

Step 6: Finalize

Insert ![description](path/NN-{type}-{slug}.png) after paragraphs.

Article Illustration Complete!
Article: [path] | Type: [type] | Density: [level] | Style: [style]
Images: X/N generated

Output Directory

illustrations/{topic-slug}/
├── source-{slug}.{ext}
├── references/           # if provided
├── outline.md
├── prompts/
└── NN-{type}-{slug}.png

Slug: 2-4 words, kebab-case. Conflict: append -YYYYMMDD-HHMMSS.

Modification

Action	Steps
Edit	Update prompt → Regenerate → Update reference
Add	Position → Prompt → Generate → Update outline → Insert
Delete	Delete files → Remove reference → Update outline

References

File	Content
references/workflow.md	Detailed procedures
references/usage.md	Command syntax
references/styles.md	Style gallery
references/prompt-construction.md	Prompt templates
references/config/first-time-setup.md	First-time setup

baoyu-article-illustrator— agent skill

Is baoyu-article-illustrator safe to install?

Article Illustrator

Two Dimensions

Types

Styles

Workflow

Step 1: Pre-check

Step 2: Analyze

Step 3: Confirm Settings ⚠️

Step 4: Generate Outline

Step 5: Generate Images

Step 6: Finalize

Output Directory

Modification

References

Audit the pieces. Scan the whole. Decide.