Security audit

UI Master

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent UI-building skill, with the main caveat that its setup examples use mutable third-party package commands users should review or pin before running.

Before installing or using this skill, treat its package-manager commands as examples to adapt: pin CLI/package versions where possible, run scaffolding and upgrades from an unprivileged clean branch or disposable workspace, and review all generated or overwritten files before committing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T08 · Insecure Dependencies

Warning

Location: references/shadcn-setup.md:16
Finding: Unpinned shadcn CLI Packages Execute Mutable Third-Party Code
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/shadcn-setup.md:120
Finding: Unpinned shadcn Update Command Can Overwrite Reviewed Component Source
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/tailwind-v4-setup.md:10
Finding: Unpinned Project Scaffolding Commands Execute Mutable npm Packages
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: references/tailwind-v4-setup.md:114
Finding: Unpinned Tailwind Upgrade Tool Can Modify Existing Project Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The documentation instructs users to run npx shadcn@latest init, which fetches and executes the latest published CLI code at runtime without version pinning. If the upstream package is compromised or a breaking/malicious release is published, users of this skill could execute unreviewed code on their development machines.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The command npx shadcn@latest add ... executes the newest remote CLI release and can modify project files. Using @latest means the exact code run is uncontrolled and may change over time, creating supply-chain risk and reducing reproducibility.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The Vite setup also uses npx shadcn@latest init -t vite, again causing execution of unpinned external code. Because this is an installation path likely to be copied verbatim by users, it meaningfully increases exposure to malicious or compromised upstream releases.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The documented add command at this line executes the remote shadcn CLI without version pinning while generating or updating source files. An attacker controlling or compromising the package distribution could leverage this to run arbitrary code in developer environments.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx shadcn@latest add button --overwrite is especially risky because it both executes unpinned code and overwrites existing component files. A malicious or bad upstream release could therefore both execute code and silently replace trusted local source with unsafe content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code renders a person's full name and email address in the UI, which affects user privacy but is not accompanied by any warning, comment, or disclosure about exposing identifying data. Under the markdown/code warning rule, privacy-affecting behavior in code can warrant a finding when there is no visible disclosure and the sensitivity is not otherwise called out.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.