ClawHub
Back to skill

Security audit

Xiaopi Superdesign

Security checks for vulnerabilities and agentic risk

Overview

This is a frontend design guidance skill with no local execution or persistence, though users should treat its CDN snippets as prototype-only.

Installers can treat this as a normal frontend design helper. For production apps, replace the CDN examples with package-managed, pinned dependencies or self-hosted assets, and review any external image or script URLs before deployment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:126
Finding
Unpinned Third-Party Scripts Loaded Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 126-140 **Vulnerability Type**: Third-party executable dependencies loaded from mutable or unverified CDN sources **Risk Level**: Medium ### Vulnerable Code ```html <!-- Import via CDN for prototypes --> <script src="https://cdn.tailwindcss.com"></script> ``` ```html <link href="https://cdn.jsdelivr.net/npm/flowbite@2.0.0/dist/flowbite.min.css" rel="stylesheet"> <script src="https://cdn.jsdelivr.net/npm/flowbite@2.0.0/dist/flowbite.min.js"></script> ``` ```html <script src="https://unpkg.com/lucide@latest/dist/umd/lucide.min.js"></script> <script>lucide.createIcons();</script> ``` ### Technical Analysis The Skill recommends loading executable JavaScript directly from public CDNs. The Tailwind URL does not specify an exact version, and the Lucide URL explicitly references the mutable `latest` release. Consequently, the content executed by generated pages can change after the Skill has been audited. None of the resources include Subresource Integrity hashes. Although Flowbite is pinned to version `2.0.0`, the browser has no cryptographic mechanism to verify that the returned file is the expected reviewed artifact. This creates a supply-chain trust boundary in which the security of generated pages depends on the CDN, package registry, package publisher, and associated publishing credentials. ### Attack Path 1. An attacker compromises an upstream package, package-publisher account, CDN, or package distribution path. 2. The attacker changes the resource returned by an unversioned or mutable URL, particularly `cdn.tailwindcss.com` or the Lucide `latest` URL. Alternatively, the attacker causes a pinned CDN resource without integrity protection to return modified content. 3. A page generated according to the Skill loads the affected external resource. 4. The browser executes the modified JavaScript within the generated page's origin and security context. 5. The malicious script can acces ...[truncated 955 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a specific, reviewed version. Do not use mutable selectors such as `latest` or unversioned CDN endpoints. 2. Prefer installing dependencies through a package manager with a committed lockfile and serving reviewed artifacts from the application's own build output. 3. If CDN delivery is required, use versioned immutable URLs and add valid Subresource Integrity hashes with the appropriate `crossorigin` attribute. 4. Restrict permitted script origins through a strong Content Security Policy. Avoid allowances such as `unsafe-inline` where feasible. 5. Review and test dependency updates before changing pinned versions. Use automated dependency and supply-chain scanning in CI. 6. Consider self-hosting security-critical frontend assets to reduce reliance on mutable third-party execution paths. 7. Document that CDN imports are limited to isolated prototypes and must not be copied into production without the controls above. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The description says to use the skill for "building landing pages, dashboards, or any user interface" and "any frontend design work," which are very broad triggers for a markdown skill. It does not provide narrower invocation constraints, explicit trigger phrases, or exclusion examples, increasing the chance of unintended activation during ordinary UI-related tasks.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to load JavaScript and CSS directly from third-party CDNs (Tailwind CDN, Flowbite, Lucide) without any warning about trust, version pinning integrity, privacy, or external network access. If these resources are compromised, changed unexpectedly, blocked, or inappropriate for the deployment environment, they can introduce supply-chain risk, client-side code execution, tracking, and nondeterministic builds.

Static analysis

No suspicious patterns detected.