Security audit

web-design-guidelines

Security checks for vulnerabilities and agentic risk

Overview

This skill is an audit-and-planning workflow for UI review and Lighthouse checks, with disclosed report/spec/issue/state side effects and explicit gates before GitHub issue creation.

Install only if you want a Portuguese-gated UI audit workflow that may read scoped UI files, run Lighthouse against deployed URLs, write a review report and SPECs, and after explicit approval create GitHub issues and hand off to an orchestrator. For safer operation, pin Lighthouse instead of using bare npx lighthouse and review the generated SPECs/issues before approving downstream work.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description scopes the skill to auditing UI code, validating Lighthouse targets, producing evidence-based findings, and turning confirmed pendencies into Draft SPECs via write-specs. However, the documented behavior in the skill file extends beyond that into Phase 5-7 actions: creating GitHub Issues via create-issues and handing work to orchestrator, which is a broader operational workflow than the manifest advertises.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L021 states an absolute constraint that the skill 'never edits application code.' But the guardrail at L045 introduces an exception allowing quick fixes after the report if explicitly requested, which contradicts the earlier absolute statement rather than merely adding implementation detail.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guardrail explicitly requires all questions, gates, and confirmations to be in pt-BR. This imposes a specific language on the user without offering a choice or documenting a justified region-specific constraint, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The skill instructs users to run npx lighthouse without pinning an explicit package version, which can fetch whatever version is current at execution time. That creates a supply-chain and reproducibility risk: a compromised or breaking upstream release could be executed in the analyst's environment, and results may vary across runs due to version drift.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This command again uses unpinned npx lighthouse, causing execution of a package version selected at runtime rather than a reviewed fixed release. In a security-sensitive workflow, that exposes users to npm supply-chain compromise and inconsistent audit behavior between environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The string pendências hard-codes Portuguese in a reusable report template. Because this is a general template rather than a clearly region-specific artifact, it imposes a specific language choice without offering localization or user opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.