Back to skill

Security audit

Remix V2 Routing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-only Remix routing guide with no hidden execution, persistence, or sensitive access.

Safe to install as a Remix reference skill. When copying its root.tsx examples into a multilingual app, adjust `lang="en"` to match the app's actual locale; review the migration adapter install command before using it, as with any dependency change.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The sample root scaffold sets <html lang="en">, which forces an English locale in the document example. Because this reference text does not mention user opt-in, locale selection, or a justified region-specific scope, it matches the policy concern for language/locale constraints in natural-language guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The ErrorBoundary example repeats <html lang="en">, again implying a fixed English locale for rendered documents. The file does not provide a user choice or explain a legitimate locale restriction, so this is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The reusable Document example sets <html lang="en">, which promotes a fixed language setting in the sample implementation. Without accompanying guidance on localization or user preference, this can be read as forcing English by default.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The Layout example uses <html lang="en">, continuing the pattern of fixed English locale in reference guidance. Since the file does not mention localization choices or a region-specific rationale, this fits the locale-policy category.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.