Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because its instructions use unpinned command-line packages and send a local CSS file to a third-party service, while part of the referenced material was only partially analyzed.
Consider the incomplete analysis and the risks of running unpinned packages or uploading local CSS before installing. The verdict is suspicious, not malicious; the scanners do not establish harmful intent, but they also do not provide complete evidence about all referenced material.
Referenced artifact was not completely inspected
Read `references/components.md` for every item, grouped by job, with its tier and what it exports. Pick by the job
The initialization command executes candor-ui@latest rather than an exact reviewed version, creating a mutable dependency execution risk. A compromised future release could execute with the coding agent's filesystem and environment access; this is a CLI supply-chain issue, not an unpinned MCP server.
The license-registration command uses an unversioned npx package, which may download and execute a mutable release when no suitable local installation exists. A compromised release would receive the license key directly, although requiring the person to run it rather than the agent reduces autonomous exposure.
The update instruction invokes an unversioned CLI, allowing npx to resolve an unreviewed release if a local dependency does not supply it. A compromised CLI could modify project files or access credentials; the component lockfile does not itself pin the executable used to perform updates.
The diagnostic command uses an unversioned npx executable that may resolve to an unreviewed package release. Diagnostics concerning the registry and license may run in a sensitive environment, so a compromised release could access project data or secrets despite the benign diagnostic purpose.
The fallback installation command executes shadcn@latest, so its executable can change without review of this skill. A compromised release could modify application source and potentially access CANDOR_LICENSE_KEY when paid-registry authentication is configured.
The MCP initialization command executes shadcn@latest rather than an exact reviewed CLI release. A compromised release could execute arbitrary code and alter the coding agent's MCP configuration; the issue is the mutable initializer package, not evidence that the configured server is malicious.
The workflow explicitly instructs the agent to send a local brand CSS file's contents to the third-party MCP service without a disclosure or authorization checkpoint. CSS is usually low sensitivity, but comments, internal URLs, proprietary branding, or embedded data can cross the project's confidentiality boundary; a read-only service can still receive sensitive input.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The documented commands execute npm package code using mutable selectors: candor-ui@latest and candor-ui@3, neither of which pins an exact release. Although this is a CLI rather than an MCP server, following these installation instructions could execute a compromised future release with the developer's permissions; installing UI components is legitimate here, but does not eliminate that supply-chain exposure.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Settings and controls: permissions, schedules, data controls.
- **api-keys** (Pro): The account's API keys: each one's name, the part of it that's safe to show, what it can do, when it was created and last used, and when it expires. Exports `ApiKeys`.
- **channel-setup** (Pro): Where agents can reach the team outside the app, one row per channel: its status, where it posts, and when an agent may post without asking. Exports `ChannelSetup`.
- **data-controls** (Pro): Control over the account's data: facts about how it's used (from the service), an export, deleting thread history, and deleting the account. Exports `DataControls`.
- **data-region** (Pro): Where the account's data lives and is processed, service by service. Exports `DataRegion`.
- **data-retention** (Pro): How long each kind of data is kept, and what happens after. Exports `DataRetention`.
The theme-check recommendation uses an unversioned npx package and may therefore execute an unreviewed release when no suitable local installation exists. The intended validation is benign, but a compromised package would still execute with the user's or agent's privileges.
The token-migration guidance recommends an unversioned npx executable, which can resolve to a mutable remote release rather than reviewed code. Because the codemod operates on project source, a compromised package could alter application files or access the developer environment; this is not specifically an MCP-server issue.
The motion-alias migration command uses an unversioned npx package, leaving its executable dependent on package resolution at execution time. A compromised release could perform arbitrary source changes or access local credentials under cover of an expected codemod.
The lint recommendation invokes an unversioned CLI through npx, which may download and execute a mutable release. Although linting is a routine development task, a compromised executable is not constrained to read-only analysis and could access or modify the workspace.
The local theme-validation instruction uses an unversioned npx executable rather than an exact reviewed dependency. Running locally avoids an explicit CSS upload, but a compromised package release could still read project files and exfiltrate accessible data.