algorithmic-art
Verdict safe, but 3 findings (1 medium, 2 low), mainly data exfiltration, skill discovery abuse. Most recent scan 2026-02-05.
This algorithmic art generation skill is SAFE with no significant security threats detected. The skill creates generative art using p5.js by first generating an algorithmic philosophy document, then expressing it through HTML/JavaScript code. The skill operates entirely locally, writing markdown philosophy files and HTML/JS art viewers. No data exfiltration, prompt injection, command injection, or credential theft patterns were found. The bundled template files (templates/viewer.html and templates/generator_template.js) contain only legitimate p5.js generative art code with proper structure and best practices. The skill correctly reads its own internal template files, which is normal and expected behavior for a self-contained skill package. Minor issues include missing optional metadata fields and some spurious file references that appear to be parsing artifacts rather than actual security concerns.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.
- Package
- 4 files, 58 KB
- SKILL.md
- 2707 words, 12+ sections
- Code
- JavaScript (1)
- License
- Complete terms in LICENSE.txt
SKILL.md covers: ALGORITHMIC PHILOSOPHY CREATION · THE CRITICAL UNDERSTANDING · HOW TO GENERATE AN ALGORITHMIC PHILOSOPHY · PHILOSOPHY EXAMPLES · ESSENTIAL PRINCIPLES · DEDUCING THE CONCEPTUAL SEED · P5.JS IMPLEMENTATION · ⚠️ STEP 0: READ THE TEMPLATE FIRST ⚠️ · TECHNICAL REQUIREMENTS · CRAFTSMANSHIP REQUIREMENTS · OUTPUT FORMAT · INTERACTIVE ARTIFACT CREATION
Findings
MEDIUM SKILL DISCOVERY ABUSE detected by YARA Skill Discovery Abusestatic
Detects manipulation of skill discovery to increase unwanted activation: perfect
SKILL.md:60
Algorithmic expression: Branching structures that subdivide recursively. Each branch slightly randomized but constrained by golden ratios. L-systems or recursive subdivision generate tree-like forms that feel both mathematical and organic. Subtle noise perturbations break perfect symmetry. Line weights diminish with each recursion level. Every branching angle the product of deep mathematical exploration.LOW Missing Optional Metadata Fields Data Exfiltrationllm
The skill manifest does not specify 'compatibility' or 'allowed-tools' fields. While these fields are optional per the agent skills specification, their absence means users cannot verify which agent tools the skill expects to use or which environments it's compatible with. This is informational only and does not indicate a security violation.
SKILL.md
compatibility: Not specified
allowed-tools: Not specifiedLOW Multiple Referenced Files Not Found in Package Data Exfiltrationllm
The skill references 14 files in its instructions, but most are not found in the package: references/generator_template.js, CDN.py, references/viewer.html, disorder.py, someone.py, assets/viewer.html, user.py, mathematical.py, velocity.py, a.py, assets/generator_template.js, the.py, scratch.py. Only templates/viewer.html and templates/generator_template.js exist. The missing .py files (CDN.py, disorder.py, someone.py, user.py, mathematical.py, velocity.py, a.py, the.py, scratch.py) appear to be artifacts from text parsing rather than intentional references, as they don't make semantic sense in the context of a p5.js art generation skill.
Files referenced: references/generator_template.js, CDN.py, references/viewer.html, disorder.py, someone.py, assets/viewer.html, user.py, mathematical.py, templates/viewer.html, velocity.py, a.py, assets/generator_template.js, the.py, templates/generator_template.js, scratch.pyWhat is in the package
| File | Kind | Size |
|---|---|---|
LICENSE.txt | doc | 11 KB |
SKILL.md | doc | 19 KB |
templates/generator_template.js | script | 7.6 KB |
templates/viewer.html | data | 20 KB |
External hosts referenced
cdnjs.cloudflare.com fonts.googleapis.com www.apache.org fonts.gstatic.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit 69c0b1a06741. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Scan history
| Date | Verdict | Findings | Change | Analyzers | Raw |
|---|---|---|---|---|---|
| SAFE | 3 | +3 | static behavioral llm trigger meta | JSON | |
| SAFE | 0 | first scan | static behavioral llm trigger meta | JSON |
Sources
- Repository: https://github.com/anthropics/skills/tree/main/skills/algorithmic-art
- Raw scan result: algorithmic-art-scan.json
- Badge for your README:
- Request a re-scan