ClawHub
Back to skill

Security audit

Ai Elements

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation skill for installing and using Vercel AI Elements UI components, with normal but mutable package-install and privacy considerations users should review.

Before installing, prefer pinned reviewed versions where possible, run the shadcn command in a normal development environment without unnecessary secrets, and review generated source and lockfile changes. If using the prompt input or speech features, add clear user consent, file limits, server-side validation, and privacy/retention disclosures.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:12
Finding

Mutable Remote Component Retrieval and Unpinned CLI Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-16
Vulnerability Type: Remote payload retrieval through an unpinned package and mutable component registry
Risk Level: Medium

bash
Install via shadcn registry:

```bash
npx shadcn@latest add https://ai-elements.vercel.app/r/[component-name]
text

The same installation pattern is prescribed again in `SKILL.md:27-30` as a required setup gate.

### Technical Analysis

The documented installation command executes the mutable `latest` version of the `shadcn` npm package and instructs it to retrieve component source from an external registry. Neither the CLI package nor the downloaded component artifact is pinned to an immutable version, commit, checksum, or signature.

Consequently, the code executed or installed when a user follows these instructions can differ from the code available at audit time. Although the referenced npm package and Vercel domain are consistent with the declared purpose of the Skill and no malicious intent was identified, compromise or unexpected modification of either upstream distribution channel could introduce arbitrary code into the target project.

The command also executes under the privileges of the invoking user. Depending on npm configuration and the package behavior, retrieved dependencies or lifecycle operations may run code during installation.

### Attack Path

1. An attacker compromises the npm package distribution channel, the mutable `latest` release, the remote component registry, or another relevant upstream delivery mechanism.
2. The attacker publishes a modified CLI package or component payload containing malicious source or installation behavior.
3. A user or Agent follows the Skill instructions and runs:
   `npx shadcn@latest add https://ai-elements.vercel.app/r/[component-name]`.
4. `npx` resolves and executes the then-current CLI release, which retrieves the then-current remote component payload.
5. The al
...[truncated 919 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace shadcn@latest with an exact, reviewed version, such as shadcn@X.Y.Z.
  2. Pin component artifacts to immutable release versions or commit-addressed registry URLs where supported.
  3. Publish and verify cryptographic checksums or signatures for downloaded component artifacts.
  4. Run installation in a restricted environment without production credentials or unnecessary filesystem access.
  5. Review generated source-code and lockfile diffs before building or executing the installed components.
  6. Use a committed lockfile and package-manager integrity verification.
  7. Disable or restrict dependency lifecycle scripts where operationally feasible.
  8. Document the exact reviewed CLI and component versions in the Skill so future installations reproduce the audited state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.

md
See [references/visualization.md](references/visualization.md) for details.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 397)May include surrounding context.

md
See [references/visualization.md](references/visualization.md) for details.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest trigger list includes broad generic terms such as Queue, Tool, Message, Conversation, and Loader, which are common words likely to appear in many unrelated contexts. This can cause unintended skill invocation, increasing the chance that the agent surfaces or follows this skill outside its intended scope, which is risky because the skill contains executable setup guidance users may trust.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs users to run npx shadcn@latest add ..., which fetches and executes code from the latest available package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users invoking the documented setup command could execute untrusted code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This repeated installation command again relies on npx shadcn@latest, causing dynamic execution of the newest published CLI version. In a skill file, such operational instructions are particularly sensitive because users may copy-paste them directly, making any upstream compromise immediately exploitable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The examples show collecting free-form text and file attachments and immediately calling sendMessage(message.text, message.files) without any warning that uploaded files and message contents may contain sensitive data and will be transmitted to backend or third-party AI services. In a reusable prompt-input component intended for chat workflows, this omission materially raises the chance of unintended data disclosure because developers may copy the example directly into production UX.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation encourages use of browser speech recognition and automatic text insertion but does not warn that microphone audio and transcripts may be captured, processed by the browser or platform, and then submitted onward to the application. In an AI chat/input component skill, this omission can cause developers to ship voice features without consent, disclosure, retention, or accidental-hot-mic safeguards, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Lines L556-L564 describe useConfirmation as a hook for accessing confirmation context, but the sample implementation shown calls useConfirmation() from within itself. That behavior would recurse rather than retrieve context, so the inline documentation/example contradicts the stated intent of the hook.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Lines L665-L673 state that useReasoning accesses reasoning context, but the example implementation destructures the result of calling useReasoning() inside useReasoning itself. That would be recursive behavior, not context access, so the documentation actively misrepresents what the hook should do.

Content

No source excerpt is available for this finding.