Frontend Design Agency

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:26 PM UTC
• Version: 1.0.1

Overview

This is a frontend design guidance skill with bundled evaluation materials, and I found no evidence of credential access, persistence, exfiltration, or automatic unsafe execution.

Install this only if you want a German-language, opinionated frontend design workflow that may steer agents toward React/TypeScript/Tailwind/shadcn-style implementations and a full design-quality process. The bundled evaluator files are not dangerous based on inspection, but they are extra QA artifacts and could be removed or documented more clearly by the publisher.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (43)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a skill for producing high-quality frontend design guidance and outcomes. The supplied code does not build, redesign, or extend a frontend, nor does it provide runtime UI/design assistance. Instead, it evaluates the frontend-design skill itself by loading markdown assets, generating category-specific judge prompts, and saving evaluation/index/template files. This is a materially different primary purpose: evaluation infrastructure for the skill, not frontend design execution. The code also performs undeclared local file access and output generation, which are inconsistent with the description.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · judge_evaluation_assets.py (reported line 182)May include surrounding context.

python

Bewerte objektiv und kritisch wie ein erfahrener Frontend-Lead/Design-Director.
"""

    return prompt

def generate_test_questions():
    """Generiert praxisnahe Testfragen für jede Kategorie"""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructions and operational guidance are presented in German throughout the markdown file, which effectively forces a specific language for users and downstream agent behavior. The file does not indicate that German is optional, user-selected, or required for a region-specific purpose, so this appears to violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instructional text is written as imperative German-only workflow steps (e.g. 'Führe', 'Extrahiere', 'Trage', 'Wiederhole') with no indication that users may choose another language or that the process is region-specific. This creates a natural-language locale policy issue because the file imposes a specific language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This JSON contains natural-language skill evaluation content centered on German-only category labels and instructions, such as "Design Thinking & Produktverständnis," without indicating any user opt-in or locale selection. Under the policy, forcing a specific language or locale without documented choice or justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The evaluator instructions are written as a German-only directive ('Deine Aufgabe', 'Bewerte den Skill') with no indication that the user may choose another language. This creates a language policy concern because the skill content effectively imposes a specific locale without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill when 'building, redesigning, or extending web-app frontends' that should look production-ready, which covers a very large range of ordinary frontend work. It does not provide explicit constraints or negative examples to distinguish when this skill should be used versus a general frontend or UI skill, increasing the risk of unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This plain-text file contains user-facing instructions such as '## Deine Aufgabe' and the test prompt in German, effectively imposing a specific language/locale. The policy allows locale constraints only when the skill offers choice or clearly documents and justifies the constraint, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This file contains user-facing natural-language instructions such as '## Deine Aufgabe' and extensive German guidance for evaluating the skill. The content effectively forces German as the operating language, and there is no opt-in, alternative language option, or stated reason that the skill must be German-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The evaluator instructions and embedded skill guidance are presented in German (for example, 'Deine Aufgabe' and the German-only skill content), which effectively forces a specific language for use and review. The file does not indicate that German is optional, user-selected, or required for a documented region-specific purpose, so this is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The judge prompt hardcodes German instructions without offering a language fallback, which can create instruction mismatch if the surrounding system or user operates in another language. While not a direct security exploit, forced language can degrade reliability, cause mis-evaluation, and be used to obscure behavior from users or downstream reviewers who expect another language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill’s activation scope is very broad ('building, redesigning, or extending web-app frontends') and can match many ordinary frontend tasks, increasing the chance the agent invokes this skill when the user did not ask for heavy design-direction, research, or framework-specific behavior. Over-broad routing is a real prompt-safety issue because it can override user intent, add unnecessary constraints, and steer outputs toward this skill’s preferred stack and workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This file contains operational instructions in German (for example, 'Deine Aufgabe' and the evaluation prompt), which imposes a specific language on users or evaluators. The policy allows locale constraints only when they are optional or clearly justified, neither of which is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents the task and evaluation instructions entirely in German, including required output context, but does not indicate that German is optional or required for a region-specific purpose. This can violate language/locale policy by implicitly forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs the evaluator to perform the task in German ('Deine Aufgabe'), which can override the user's preferred language or expected output format without explicit opt-in. In an evaluation or agent pipeline, this can cause policy drift, reduce interoperability with downstream tooling, and create prompt-control behavior that is unrelated to the actual security task.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file forces German ('Deine Aufgabe') for the evaluator instructions without any user opt-in or locale negotiation. While not a code-execution issue, forced language can degrade correctness, accessibility, and auditability by causing misunderstandings for users, reviewers, or downstream systems expecting another language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is very broad ('building, redesigning, or extending web-app frontends') and lacks exclusion boundaries, which can cause the agent to activate in many unrelated frontend situations. Over-broad activation increases the chance that stronger, embedded instructions in the skill override more task-specific guidance, leading to scope confusion and potentially unsafe or low-quality outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The usage guidance contains many generic triggers like dashboards, landing pages, forms, settings, onboarding, and responsive surfaces, which are common across a large fraction of frontend work. This ambiguity makes the skill likely to trigger when not necessary, creating prompt-routing risk where broad stylistic or process instructions displace more relevant, narrower skills or direct user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file instructs the evaluator in German ('Deine Aufgabe', 'Bewerte den Skill') and the embedded skill content is entirely written as mandatory guidance in German, with no opt-in or alternative locale offered. This creates a language/locale policy issue because it implicitly requires a specific language rather than allowing user preference or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language instructions, prompts, comments, and generated content are written entirely in German, including the LLM-facing evaluation prompt and usage steps. This imposes a specific language/locale without any opt-in, alternative, or documented region-specific justification, which matches the language-policy violation criterion.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill for building or redesigning production-ready web frontends, but this file implements an offline evaluation utility that reads the skill docs and reference assets, generates judge prompts, and writes evaluation artifacts. That behavior is about auditing and scoring the skill itself rather than designing or extending a frontend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The main execution path creates an evaluation setup: it loads markdown assets, generates judge prompts for 10 categories, and writes index/results JSON files. These operations are not an obvious implementation detail of a frontend design agency skill whose stated purpose is producing high-quality frontend design output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This file’s natural-language guidance, section headings, checklist, and usage examples are predominantly in German, which effectively imposes a specific language on users of the template. The policy allows locale constraints only when they are optional, user-selectable, or clearly justified as region-specific, none of which is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Line L003 uses an imperative German instruction ('Nutze diese Regeln ...') and the entire file is written only in German. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.