Design Style

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:25 AM UTC
• Version: 1.0.0

Overview

This is a frontend design prompt library that reads local style guides; it has some broad styling and third-party asset recommendations but no hidden persistence or data-stealing behavior.

Install only if you want a broad frontend design-style prompt library. Review generated code before deploying, especially any Google Fonts imports, remote texture URLs, animation libraries, forced dark/light themes, uppercase text, or motion-heavy effects; replace external assets with local or approved resources for privacy-sensitive sites.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: prompts/Industrial.md:167
• Finding: Unpinned Third-Party Carbon-Fiber Texture<![CDATA[ ## Vulnerability Details **File Location**: `prompts/Industrial.md:167-169` **Vulnerability Type**: Untrusted runtime asset dependency **Risk Level**: Medium ### Vulnerable Code ```md ### Textures & Patterns Textures differentiate this style from flat competitors. Apply strategically: - **Noise Overlay (Background)**: SVG-based fractal noise at 20-30% opacity with `mix-blend-overlay`. Simulates the micro-texture of matte plastic. Applied to entire page background via StyleWrapper. - **Carbon Fiber Pattern**: External texture URL (`transparenttextures.com/patterns/carbon-fibre.png`) at 10-20% opacity on tech-heavy sections (device bezels, dark panels). Use `mix-blend-overlay` or `mix-blend-multiply`. ``` ### Technical Analysis The prompt directs the agent to incorporate a mutable, unversioned asset hosted by `transparenttextures.com` into generated websites. When the generated page is visited, each browser may request the image directly from the third-party server. The resource is not locally vendored, version-pinned, or protected by an integrity mechanism. Its availability and returned image content therefore remain under the control of the external provider or any attacker who compromises the provider or domain. Although an image response does not ordinarily provide script execution in a standard CSS image context, the external operator can: - Observe visitor IP addresses, timestamps, user-agent details, referrer information subject to browser policy, and other request metadata. - Track visits through request correlation. - Replace or remove the image and affect the generated application's appearance. - Degrade availability or cause repeated failed network requests. ### Attack Path 1. A user requests an interface using the Industrial design style. 2. The agent loads `prompts/Industrial.md` and follows its texture guidance. 3. The generated CSS references `transparenttextures.com/patterns/carbon-fibre.png`. 4. The application is depl ...[truncated 700 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the external texture with a locally generated CSS or SVG pattern. 2. If the image must be used, download and review it, then vendor it within the application repository. 3. Record a cryptographic hash of the reviewed asset and verify it during the build process. 4. Require explicit user approval before introducing any runtime request to a third-party domain. 5. Configure a restrictive Content Security Policy, particularly `img-src`, that permits only required and reviewed sources. 6. Document any unavoidable external service, including its privacy implications, retention behavior, and availability dependency. ]]>

T08 · Insecure Dependencies

Warning

• Location: prompts/Web3.md:149
• Finding: Unpinned Third-Party Cube Texture<![CDATA[ ## Vulnerability Details **File Location**: `prompts/Web3.md:149-152` **Vulnerability Type**: Untrusted runtime asset dependency **Risk Level**: Medium ### Vulnerable Code ```md * **External Texture Overlays**: * Example: `bg-[url('https://www.transparenttextures.com/patterns/cubes.png')] opacity-5` * Very subtle, barely visible patterns for visual interest ``` ### Technical Analysis The Web3 prompt provides an implementation example that loads a texture directly from an external, mutable URL. If the agent copies this example into generated frontend code, deployed pages will initiate runtime requests to a service that is not controlled by the application owner. The asset is not versioned, locally reviewed, or integrity-pinned. Consequently, the application owner cannot guarantee the continued availability or visual content of the resource. The external server can observe visitor request metadata and correlate access patterns. A compromise or ownership change affecting the external domain could allow an attacker to replace the visual content. Standard browser handling of a CSS background image limits the expected impact to image rendering rather than arbitrary script execution, but it does not eliminate privacy, integrity, or availability risks. ### Attack Path 1. A user requests a Web3-styled frontend. 2. The agent reads `prompts/Web3.md`. 3. The agent incorporates the supplied Tailwind background-image example. 4. The generated application is deployed with the remote URL unchanged. 5. Visitors load the affected page and their browsers contact `www.transparenttextures.com`. 6. The remote operator observes request metadata and supplies the rendered texture. 7. A compromised or unavailable provider can alter the visual result or disrupt resource loading. ### Impact Assessment The issue does not grant local shell access, application privileges, or direct script execution. Its scope covers deployed pages that use the generated style and v ...[truncated 221 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the example with a pure CSS gradient, local SVG, or locally hosted reviewed image. 2. Do not generate runtime third-party requests unless the user explicitly requests and approves them. 3. Vendor required assets and track them with cryptographic hashes or normal repository integrity controls. 4. Add guidance directing agents to preserve the target application's privacy and Content Security Policy requirements. 5. Restrict production `img-src` directives to trusted first-party locations wherever possible. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (19)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: There is a material mismatch between the broad declared purpose and the actual code behavior. The description promises a skill for building or improving frontend interfaces and selecting an appropriate design style prompt. However, the provided shell script merely inspects a local prompts directory, counts .md files, and prints their names plus a usage example. That is a supporting utility for discovering available styles, not the core functionality described. It accesses only local prompt files and performs no frontend generation, styling, framework integration, or prompt selection beyond listing filenames.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description says this skill should be used proactively for frontend/UI creation and styling work and that it retrieves appropriate design-system prompts to produce frontend code. The supplied code does not implement frontend generation, UI styling assistance, or prompt retrieval for user-facing design tasks. Instead, it is a maintenance/verification shell script for checking whether the skill is correctly configured on disk. That is a materially different primary purpose, so this is a clear description-behavior mismatch.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The activation criteria are extremely broad, causing this skill to trigger on almost any frontend-related request. In an agent environment, overbroad auto-invocation can override more specific skills, pull in unnecessary prompt context, and increase the chance of instruction collision or unintended behavior across many normal user requests.

Hidden Instructions

High

• Category: Prompt Injection

Content

### Example: Vue 3 + Plain CSS

```vue
<!-- components/HeroSection.vue -->
<!-- Using Neo-brutalism.md design system -->

<template>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The 'automatically invoked' conditions are ambiguous and insufficiently constrained, which can make the agent invoke this skill in contexts where design-style guidance is irrelevant or conflicting. That increases prompt-scope sprawl and can degrade safety by making routing less predictable, especially in multi-skill systems where broad triggers can hijack workflow selection.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The prompt states the palette is 'strictly light mode,' which imposes a display/locale-style preference on all outputs. Because the file does not present this as optional or user-selectable, it can violate policy against forcing a specific presentation preference without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The prompt makes uppercase treatment mandatory for headings, buttons, and labels without allowing user preference, language context, or accessibility exceptions. While not a code-execution or data-security issue, this is a genuine accessibility and safety-of-output problem because it can degrade readability, pronunciation, localization quality, and assistive-technology usability across generated interfaces.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The instruction "Mode: Light (Permanent - no dark mode)" imposes a specific UI mode as a hard requirement. This is a natural-language policy concern because it forces a presentation preference without user opt-in or a documented region/compliance justification.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The prompt explicitly mandates marquee scrolling, blinking, pulsing, and rainbow animations as required style elements, which can produce motion-heavy or distracting UI without first warning the user or making reduced-motion behavior the default. Although the file later mentions `prefers-reduced-motion`, the skill still strongly pushes sensory-intensive patterns and may cause the agent to generate inaccessible interfaces for motion-sensitive users unless the user actively objects.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The prompt requires exclusively handwritten or marker-style fonts for all headings and body text, which can reduce readability, legibility, and accessibility for users with dyslexia, low vision, cognitive disabilities, or users expecting conventional UI typography. Because this is framed as a hard requirement rather than a stylistic preference with accessibility checks or user opt-in, the skill can systematically generate inaccessible interfaces across many outputs.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The design-system instructions explicitly require 'Dark Mode Only' and state that high contrast is non-negotiable, which forces a particular presentation choice rather than offering the user a choice. Under the policy rule for natural-language constraints, this is a style/locale-like mandate without opt-in or a clearly documented region/compliance justification.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The prompt hard-codes a single 'Dark Mode Only' Bitcoin/DeFi visual system and repeatedly frames it as mandatory, which can override user preferences, brand requirements, accessibility needs, or platform theming constraints. In a frontend design skill, this is risky because the model may confidently impose an unsuitable aesthetic rather than first confirming whether the user actually wants that style or needs light-mode/accessibility alternatives.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The prompt hard-codes use of the Google-hosted 'Outfit' font and explicitly specifies its import source without offering an opt-in or a self-hosted/privacy-preserving alternative. This can cause unnecessary third-party network requests, exposing user IP address, user agent, referrer, and page access metadata to the font provider, which is a real privacy issue even though it is not an exploit-oriented security flaw.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The instructions prescribe a single font family, 'Outfit', as mandatory design guidance. This can create a language/locale policy issue because a fixed typeface may not be appropriate for all scripts or regional typography needs, and the file does not offer user choice or note any locale constraints.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The prompt prescribes "Playfair Display" and "Inter" as the only fonts to use, and later reinforces this as a strict requirement. This can violate language/locale flexibility expectations because these Latin-centric typography choices may not be appropriate for all scripts or locales, and the file does not offer any user choice or documented regional justification.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The prompt specifies "Font Family: Roboto (Google Fonts) - The canonical Material Design typeface" as a fixed requirement. This imposes a specific language/script presentation choice without offering user opt-in or alternatives, which can conflict with locale/language policy expectations for multilingual contexts.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The motion section states "NO translate/lift effects — too trendy for this timeless aesthetic" at L417, but earlier button guidance explicitly prescribes a subtle lift on hover with `-translate-y-0.5` at L285 and later accessibility guidance again allows subtle shifts at L521. This is an internal intent/documentation contradiction about whether translate-based motion is part of the design system.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The instruction mandates uppercase for almost all headings and labels as a fixed stylistic rule. This imposes a specific language presentation convention without offering user choice or noting exceptions for locale, accessibility, or content needs, which fits the policy concern around forced language/locale behavior in natural-language instructions.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The design system explicitly states "Dark Mode Only," which imposes a fixed presentation mode rather than offering the user a choice or opt-in. Under the policy criteria, forcing a specific mode/locale-style preference in natural-language instructions can be a policy concern when no alternative is provided.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:109