Security audit

Xiaopi Superdesign

Security checks for vulnerabilities and agentic risk

Overview

This is a frontend design guidance skill with no local execution or persistence, though users should treat its CDN snippets as prototype-only.

Installers can treat this as a normal frontend design helper. For production apps, replace the CDN examples with package-managed, pinned dependencies or self-hosted assets, and review any external image or script URLs before deployment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:126
Finding: Unpinned Third-Party Scripts Loaded Without Integrity Verification
Content: View full analysis
``` ```html ``` ```html ``` ### Technical Analysis The Skill recommends loading executable JavaScript directly from public CDNs. The Tailwind URL does not specify an exact version, and the Lucide URL explicitly references the mutable `latest` release. Consequently, the content executed by generated pages can change after the Skill has been audited. None of the resources include Subresource Integrity hashes. Although Flowbite is pinned to version `2.0.0`, the browser has no cryptographic mechanism to verify that the returned file is the expected reviewed artifact. This creates a supply-chain trust boundary in which the security of generated pages depends on the CDN, package registry, package publisher, and associated publishing credentials. ### Attack Path 1. An attacker compromises an upstream package, package-publisher account, CDN, or package distribution path. 2. The attacker changes the resource returned by an unversioned or mutable URL, particularly `cdn.tailwindcss.com` or the Lucide `latest` URL. Alternatively, the attacker causes a pinned CDN resource without integrity protection to return modified content. 3. A page generated according to the Skill loads the affected external resource. 4. The browser executes the modified JavaScript within the generated page's origin and security context. 5. The malicious script can acces ...[truncated 955 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The description says to use the skill for "building landing pages, dashboards, or any user interface" and "any frontend design work," which are very broad triggers for a markdown skill. It does not provide narrower invocation constraints, explicit trigger phrases, or exclusion examples, increasing the chance of unintended activation during ordinary UI-related tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs users to load JavaScript and CSS directly from third-party CDNs (Tailwind CDN, Flowbite, Lucide) without any warning about trust, version pinning integrity, privacy, or external network access. If these resources are compromised, changed unexpectedly, blocked, or inappropriate for the deployment environment, they can introduce supply-chain risk, client-side code execution, tracking, and nondeterministic builds.
Content: No source excerpt is available for this finding.