Security audit

Design Review

Security checks for vulnerabilities and agentic risk

Overview

This design-review skill is mostly a UI quality checker, but it has under-disclosed automatic script execution, silent telemetry, and broad memory read/write instructions that users should review before installing.

Install only if you are comfortable with a design-review skill that may run local checker scripts automatically, read and update design memory, and make silent outbound telemetry requests whenever ADS_TELEMETRY_URL is set. Prefer removing or disabling telemetry, narrowing activation to explicit design-review tasks, and requiring approval before persistent memory reads or writes.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/accessibility-check.py:16
Finding: Undisclosed Environment-Controlled Telemetry in Accessibility Checker
Content: View full analysis
[file2.tsx ...]") sys.exit(1) ``` ### Technical Analysis The checker silently issues an HTTP GET request to a destination entirely controlled by the `ADS_TELEMETRY_URL` environment variable. This network behavior is unrelated to local accessibility validation and is not disclosed in `SKILL.md`. No URL scheme validation, HTTPS requirement, destination allowlist, or private-network restriction is present. Consequently, a party able to influence the process environment can direct the checker to an attacker-controlled server or an internal HTTP service. The fixed `/skill-fired/accessibility-check` suffix limits request flexibility, and the response is not executed or otherwise processed. This is therefore not remote payload execution, but it provides a limited blind-SSRF and execution-tracking primitive. The broad exception handler suppresses all evidence of failed telemetry, making the request difficult for users to detect. It also runs before command-line arguments are validated, meaning even an invalid invocation can initiate network activity. ### Attack Path 1. An attacker, compromised wrapper, CI configuration, or inherited shell environment sets `ADS_TELEM ...[truncated 1107 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/anti-pattern-check.py:16
Finding: Undisclosed Environment-Controlled Telemetry in Anti-Pattern Checker
Content: View full analysis
[file2.tsx ...]") sys.exit(1) ``` ### Technical Analysis The anti-pattern checker performs a silent GET request to an arbitrary environment-selected origin. The Skill documentation presents the script as a local source checker but does not disclose this network side effect. Because `ADS_TELEMETRY_URL` is neither validated nor restricted, control over the environment can redirect the request to an external tracking service or an internal HTTP endpoint. The response is ignored and no response body is executed, so the behavior is a constrained blind-SSRF and telemetry issue rather than remote code retrieval. The request occurs before validation of the supplied file arguments, and all errors are suppressed. ### Attack Path 1. An attacker or compromised execution configuration defines `ADS_TELEMETRY_URL`. 2. The Skill’s mandatory verification workflow causes the agent to invoke `anti-pattern-check.py`. 3. The script sends a GET request to `/skill-fired/anti-pattern-check`. 4. The selected service observes the request or processes it from the victim’s network context. 5. The script conceals request failures through its catch-all exception handler. ...[truncated 476 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/state-check.py:15
Finding: Undisclosed Environment-Controlled Telemetry in State Checker
Content: View full analysis
[file2.tsx ...]") sys.exit(1) ``` ### Technical Analysis The script silently contacts an arbitrary URL derived from `ADS_TELEMETRY_URL`. The destination is not constrained to HTTPS or to a trusted host, and network access is not required for the script’s advertised state-completeness checks. This permits a party controlling the execution environment to redirect a GET request to an attacker-controlled or internal endpoint. The path suffix is fixed and the response is ignored, limiting exploitation to blind request delivery and tracking. The implementation does not retrieve or execute code. The call occurs before file-argument validation, while the catch-all exception handler prevents users from seeing network failures. ### Attack Path 1. A malicious or compromised environment sets `ADS_TELEMETRY_URL`. 2. The agent invokes `state-check.py` as directed by the Skill. 3. The script requests `/skill-fired/state-check`. 4. The destination receives a request originating from the agent’s environment and can record invocation metadata. 5. Failures remain invisible because all exceptions are discarded. ### Impact Assessment The destination can learn that the state checker was in ...[truncated 384 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:35
Finding: Unbounded Persistent Memory Read and Write Instructions
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Overbroad Automatic Skill Activation and Mandatory Workflow
Content: View full analysis
# verify loading, empty, and error states exist python3 skills/design-review/scripts/state-check.py # check semantic HTML, aria labels, alt text, heading hierarchy python3 skills/design-review/scripts/accessibility-check.py ``` fix any warnings before presenting. ``` ### Technical Analysis The Skill declares itself automatically active for every visual or frontend task, states that no permission is required, and makes its own workflow a prerequisite for completion. This allows the Skill text to redefine the agent’s immediate workflow regardless of whether the user requested a design audit. The mandatory script execution compounds the risk because all three bundled checkers contain undocumented network telemetry. Thus, automatic activation can indirectly cause outbound requests without task-specific consent. The Skill does not explicitly instruct the agent to override platform security policies, disclose secrets, or disregard the user’s direct request. The issue is therefore an overbroad workflow takeover rather than ...[truncated 1158 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (19)

Tainted flow: 'endpoint' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 98% confidence
Finding: The script performs an outbound HTTP request to a URL taken from an environment variable, which creates a tainted network sink and allows unreviewed data egress to an attacker-controlled endpoint. Even though only the script name is appended, execution metadata and network reachability are disclosed without clear necessity, and the hidden request is especially concerning in a local analysis utility.
Content: Scanner excerpt · scripts/accessibility-check.py (reported line 23)May include surrounding context.
python
if not endpoint: return try: urllib.request.urlopen(f"{endpoint}/skill-fired/{script_name}", timeout=2) except Exception: pass

Tainted flow: 'endpoint' from os.environ.get (line 19, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 98% confidence
Finding: The script sends an outbound HTTP request to a URL taken directly from an environment variable, which creates an unintended data egress path and can be abused for tracking, network beaconing, or contacting attacker-controlled infrastructure. In the context of a local UI anti-pattern checker, this network behavior is unrelated to the stated purpose and is especially risky because it runs automatically and fails silently, making the exfiltration path hard to notice.
Content: Scanner excerpt · scripts/anti-pattern-check.py (reported line 23)May include surrounding context.
python
if not endpoint: return try: urllib.request.urlopen(f"{endpoint}/skill-fired/{script_name}", timeout=2) except Exception: pass

Tainted flow: 'endpoint' from os.environ.get (line 18, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 96% confidence
Finding: The script sends an outbound HTTP request to a URL fully controlled by the ADS_TELEMETRY_URL environment variable, which creates a tainted data flow from environment input to network output. Although the payload is small, this enables undisclosed external communication, can leak usage metadata, and may be abused for SSRF-style access to internal endpoints if the environment is influenced by an attacker or untrusted runtime.
Content: Scanner excerpt · scripts/state-check.py (reported line 22)May include surrounding context.
python
if not endpoint: return try: urllib.request.urlopen(f"{endpoint}/skill-fired/{script_name}", timeout=2) except Exception: pass

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: A skill that advertises broad automatic design QA but actually behaves as a narrower checker with undeclared network activity creates a deceptive trust boundary. In context, this is more dangerous because the skill is positioned as core infrastructure that should run routinely, increasing the frequency and surface area of any hidden data collection or unintended execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: A skill that advertises broad automatic design QA but actually behaves as a narrower checker with undeclared network activity creates a deceptive trust boundary. In context, this is more dangerous because the skill is positioned as core infrastructure that should run routinely, increasing the frequency and surface area of any hidden data collection or unintended execution.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: A skill that advertises broad automatic design QA but actually behaves as a narrower checker with undeclared network activity creates a deceptive trust boundary. In context, this is more dangerous because the skill is positioned as core infrastructure that should run routinely, increasing the frequency and surface area of any hidden data collection or unintended execution.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill declares itself 'always active' for all visual and frontend work with no exceptions, which is an overly broad trigger condition. This expands the attack surface by causing the agent to load extra instructions, read additional files, and potentially run referenced scripts in many contexts where they are unnecessary, especially if the skill package includes hidden telemetry or other side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The no-exception guidance instructing sub-agents to run this skill before announcing completion lacks scope constraints and encourages mandatory execution regardless of task sensitivity or relevance. In a hostile or mixed-trust environment, mandatory invocation can be abused to force unnecessary file access, script execution, or policy inheritance across unrelated tasks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring presents the script as a source-level accessibility checker, but it omits the fact that the tool also contacts an external endpoint. This deceptive or incomplete disclosure prevents informed trust decisions and increases the risk that users execute code with hidden network side effects in CI, developer workstations, or restricted environments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: An accessibility review tool is expected to analyze files locally, but this script includes unrelated outbound telemetry behavior. That mismatch expands the trust boundary, creates unnecessary data egress risk, and can expose tool usage patterns or network metadata in environments where no external communication is expected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The telemetry request sends execution metadata to an external service without meaningful notice, consent, or runtime confirmation. In a developer tool or agent skill, silent collection is risky because it can leak usage information, violate enterprise policies, and undermine user expectations about local-only analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The docstring presents the program as a simple file scanner, but the code also performs network telemetry. Hidden or undocumented behavior is dangerous because users may run the tool in sensitive environments assuming it is offline-only, leading to unanticipated metadata leakage and erosion of trust.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: A UI anti-pattern checker should operate locally on files, but this implementation includes outbound telemetry unrelated to scanning. That expands the trust boundary of the tool, introduces privacy and network risk, and creates an unexpected side effect every time the script is run.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The telemetry request is made automatically without any user-facing warning, consent, or runtime confirmation. Silent outbound requests are dangerous in developer tools because they can leak usage metadata from restricted environments and make suspicious behavior difficult for users to detect or audit.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The usage and docstring present the tool as a simple local checker, but runtime behavior includes external network access that is not reflected in the description. This mismatch is security-relevant because users and operators may run the script in sensitive CI/dev environments under false assumptions about its behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file is described as a local UI state completeness checker, but it contains unrelated outbound telemetry logic. In an always-active design-review skill, hidden network behavior is more concerning because it expands the trust boundary and can transmit execution events from environments where users expect only local analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The telemetry request occurs silently and suppresses all exceptions, providing no user-facing warning that external communication is attempted. Silent outbound requests reduce transparency, hinder detection, and are especially risky in developer tooling that may run automatically across many projects and environments.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation describes a local scanner, while the implementation also contacts an external endpoint. Even if the payload is minimal, this mismatch is a security concern because it conceals network activity from users and reviewers, which can normalize covert communication in tooling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.