ClawHub
Back to skill

Security audit

Tailwind V4

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Tailwind CSS v4 skill with examples that fit its stated frontend styling purpose.

Reasonable to install as a Tailwind frontend guidance skill. Review generated dependency versions before applying them to a real project, and be aware that the dark-mode examples use browser localStorage and may include optional external Google Fonts links.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Unvalidated Output Injection

High
Category
Output Handling
Content
<html lang="en" suppressHydrationWarning>
      <head>
        <script
          dangerouslySetInnerHTML={{
            __html: `
              (function() {
                const theme = localStorage.getItem('theme') || 'system';
Confidence
20% confidence
Finding
dangerouslySetInnerHTML={

Instruction Override

High
Category
Prompt Injection
Content
- No FOUC (flash of unstyled content)

**Cons**:
- Users can't override system preference
- No manual toggle control
- Changes when system setting changes
Confidence
27% confidence
Finding
override system

Instruction Override

High
Category
Prompt Injection
Content
**Pros**:
- Full JavaScript control
- User can override system preference
- Easy to implement manual toggle
- Widely supported pattern
Confidence
27% confidence
Finding
override system

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.