Security audit

Bestax: Custom Component

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent documentation-only guide for building bestax/Bulma React components, with no hidden execution, credential handling, persistence, or unrelated data access found.

Install this skill if you want guidance for building bestax/Bulma components. Expect it to tell your agent to inspect the component catalog, edit normal project source/docs/test/style files, and run package-manager verification commands. Review proposed file changes as usual, especially in a monorepo, but no suspicious hidden behavior was found.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (13)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
- `references/component-catalog.md` — **start here.** Every documented component with a one-line

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 133)May include surrounding context.
md
`Columns` take a `gap` prop). Before writing `style={{ … }}` anywhere, translate each declaration: | Inline style you're about to write | Helper props instead | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `marginTop: '1rem'` (any margin/padding) | `mt="4"` — `m`/`mt`/`mx`/`p`/`py`/… scale: `1`=0.25rem, `2`=0.5rem, `3`=0.75rem, `4`=1rem, `5`=1.5rem, `6`=3rem (nearest step) | | `textAlign: 'center'` | `textAlign="centered"` (also `left`, `right`, `justified`) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
| Inline style you're about to write | Helper props instead | | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `marginTop: '1rem'` (any margin/padding) | `mt="4"` — `m`/`mt`/`mx`/`p`/`py`/… scale: `1`=0.25rem, `2`=0.5rem, `3`=0.75rem, `4`=1rem, `5`=1.5rem, `6`=3rem (nearest step) | | `textAlign: 'center'` | `textAlign="centered"` (also `left`, `right`, `justified`) | | `color: '#…'` | `textColor` with the nearest Bulma color: `primary`, `link`, `info`, `success`, `warning`, `danger`, `white`, `black`, `grey` (+ `grey-light`, `grey-dark`, …) | | `backgroundColor: '#…'` | `bgColor` (same palette) | | `fontSize: …` | `textSize="1"`…`"7"` (`1` largest) — for headings use `Title`/`SubTitle` `size` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
md
| `marginTop: '1rem'` (any margin/padding) | `mt="4"` — `m`/`mt`/`mx`/`p`/`py`/… scale: `1`=0.25rem, `2`=0.5rem, `3`=0.75rem, `4`=1rem, `5`=1.5rem, `6`=3rem (nearest step) | | `textAlign: 'center'` | `textAlign="centered"` (also `left`, `right`, `justified`) | | `color: '#…'` | `textColor` with the nearest Bulma color: `primary`, `link`, `info`, `success`, `warning`, `danger`, `white`, `black`, `grey` (+ `grey-light`, `grey-dark`, …) | | `backgroundColor: '#…'` | `bgColor` (same palette) | | `fontSize: …` | `textSize="1"`…`"7"` (`1` largest) — for headings use `Title`/`SubTitle` `size` | | `fontWeight: …` | `textWeight`: `light`, `normal`, `medium`, `semibold`, `bold` | | `textTransform`, italics | `textTransform`: `uppercase`, `lowercase`, `capitalized`, `italic` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
md
| `textAlign: 'center'` | `textAlign="centered"` (also `left`, `right`, `justified`) | | `color: '#…'` | `textColor` with the nearest Bulma color: `primary`, `link`, `info`, `success`, `warning`, `danger`, `white`, `black`, `grey` (+ `grey-light`, `grey-dark`, …) | | `backgroundColor: '#…'` | `bgColor` (same palette) | | `fontSize: …` | `textSize="1"`…`"7"` (`1` largest) — for headings use `Title`/`SubTitle` `size` | | `fontWeight: …` | `textWeight`: `light`, `normal`, `medium`, `semibold`, `bold` | | `textTransform`, italics | `textTransform`: `uppercase`, `lowercase`, `capitalized`, `italic` | | `display: 'flex'` + flex properties | same-named props: `display="flex"`, `flexDirection`, `justifyContent`, `alignItems`, `flexWrap` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
| `color: '#…'` | `textColor` with the nearest Bulma color: `primary`, `link`, `info`, `success`, `warning`, `danger`, `white`, `black`, `grey` (+ `grey-light`, `grey-dark`, …) | | `backgroundColor: '#…'` | `bgColor` (same palette) | | `fontSize: …` | `textSize="1"`…`"7"` (`1` largest) — for headings use `Title`/`SubTitle` `size` | | `fontWeight: …` | `textWeight`: `light`, `normal`, `medium`, `semibold`, `bold` | | `textTransform`, italics | `textTransform`: `uppercase`, `lowercase`, `capitalized`, `italic` | | `display: 'flex'` + flex properties | same-named props: `display="flex"`, `flexDirection`, `justifyContent`, `alignItems`, `flexWrap` | | `height: '100%'` on a flex child | `flexGrow="1"` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
| `backgroundColor: '#…'` | `bgColor` (same palette) | | `fontSize: …` | `textSize="1"`…`"7"` (`1` largest) — for headings use `Title`/`SubTitle` `size` | | `fontWeight: …` | `textWeight`: `light`, `normal`, `medium`, `semibold`, `bold` | | `textTransform`, italics | `textTransform`: `uppercase`, `lowercase`, `capitalized`, `italic` | | `display: 'flex'` + flex properties | same-named props: `display="flex"`, `flexDirection`, `justifyContent`, `alignItems`, `flexWrap` | | `height: '100%'` on a flex child | `flexGrow="1"` | | `display: 'none'` | `visibility="hidden"`, or responsive `display*` props (`displayMobile`, `displayTablet`, …) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 143)May include surrounding context.
md
| `fontWeight: …` | `textWeight`: `light`, `normal`, `medium`, `semibold`, `bold` | | `textTransform`, italics | `textTransform`: `uppercase`, `lowercase`, `capitalized`, `italic` | | `display: 'flex'` + flex properties | same-named props: `display="flex"`, `flexDirection`, `justifyContent`, `alignItems`, `flexWrap` | | `height: '100%'` on a flex child | `flexGrow="1"` | | `display: 'none'` | `visibility="hidden"`, or responsive `display*` props (`displayMobile`, `displayTablet`, …) | Spacing, typography, and flex helpers are on every component; `textColor`/`bgColor` are on

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 35)May include surrounding context.
md
`BulmaClassesProps` is the union of all helper prop groups, composed from per-concern hooks that can also be used on their own: | Group | Hook | Representative props | | ---------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Color | `useColorClasses` | `color`, `colorShade`, `backgroundColor`, `backgroundColorShade` | | Spacing | `useSpacingClasses` | `m`, `mt`, `mr`, `mb`, `ml`, `mx`, `my`, `p`, `pt`, `pr`, `pb`, `pl`, `px`, `py` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 37)May include surrounding context.
md
| Group | Hook | Representative props | | ---------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Color | `useColorClasses` | `color`, `colorShade`, `backgroundColor`, `backgroundColorShade` | | Spacing | `useSpacingClasses` | `m`, `mt`, `mr`, `mb`, `ml`, `mx`, `my`, `p`, `pt`, `pr`, `pb`, `pl`, `px`, `py` | | Typography | `useTypographyClasses` | `textSize`, `textAlign`, `textTransform`, `textWeight`, `fontFamily` (+ responsive variants) | | Visibility | `useVisibilityClasses` | `display`, `visibility` (+ per-viewport variants) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 38)May include surrounding context.
md
| Group | Hook | Representative props | | ---------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Color | `useColorClasses` | `color`, `colorShade`, `backgroundColor`, `backgroundColorShade` | | Spacing | `useSpacingClasses` | `m`, `mt`, `mr`, `mb`, `ml`, `mx`, `my`, `p`, `pt`, `pr`, `pb`, `pl`, `px`, `py` | | Typography | `useTypographyClasses` | `textSize`, `textAlign`, `textTransform`, `textWeight`, `fontFamily` (+ responsive variants) | | Visibility | `useVisibilityClasses` | `display`, `visibility` (+ per-viewport variants) | | Flexbox | `useFlexboxClasses` | `flexDirection`, `flexWrap`, `justifyContent`, `alignItems`, `alignContent`, `alignSelf`, `flexGrow`, `flexShrink` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 39)May include surrounding context.
md
| ---------- | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Color | `useColorClasses` | `color`, `colorShade`, `backgroundColor`, `backgroundColorShade` | | Spacing | `useSpacingClasses` | `m`, `mt`, `mr`, `mb`, `ml`, `mx`, `my`, `p`, `pt`, `pr`, `pb`, `pl`, `px`, `py` | | Typography | `useTypographyClasses` | `textSize`, `textAlign`, `textTransform`, `textWeight`, `fontFamily` (+ responsive variants) | | Visibility | `useVisibilityClasses` | `display`, `visibility` (+ per-viewport variants) | | Flexbox | `useFlexboxClasses` | `flexDirection`, `flexWrap`, `justifyContent`, `alignItems`, `alignContent`, `alignSelf`, `flexGrow`, `flexShrink` | | Other | `useOtherClasses` | `float`, `overflow`, `overflowX`, `overflowY`, `radius`, `shadow`, `interaction`, `cursor`, `skeleton`, `clearfix`, `pos`, `relative`, `fullHeight`, `aspectRatio`, `responsive` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 40)May include surrounding context.
md
| Color | `useColorClasses` | `color`, `colorShade`, `backgroundColor`, `backgroundColorShade` | | Spacing | `useSpacingClasses` | `m`, `mt`, `mr`, `mb`, `ml`, `mx`, `my`, `p`, `pt`, `pr`, `pb`, `pl`, `px`, `py` | | Typography | `useTypographyClasses` | `textSize`, `textAlign`, `textTransform`, `textWeight`, `fontFamily` (+ responsive variants) | | Visibility | `useVisibilityClasses` | `display`, `visibility` (+ per-viewport variants) | | Flexbox | `useFlexboxClasses` | `flexDirection`, `flexWrap`, `justifyContent`, `alignItems`, `alignContent`, `alignSelf`, `flexGrow`, `flexShrink` | | Other | `useOtherClasses` | `float`, `overflow`, `overflowX`, `overflowY`, `radius`, `shadow`, `interaction`, `cursor`, `skeleton`, `clearfix`, `pos`, `relative`, `fullHeight`, `aspectRatio`, `responsive` |

Static analysis

No suspicious patterns detected.