ClawHub
Back to skill

Security audit

ui-design-guide

Security checks for vulnerabilities and agentic risk

Overview

This is a UI design guidance skill with disclosed, purpose-aligned prototype and asset-handling instructions, though users should be careful with remote asset downloads.

Install only if you want a strongly opinionated UI design workflow. When it suggests downloading images, icons, or fonts, use trusted HTTPS sources, avoid internal/private URLs, check licensing and file contents, and do not execute downloaded files just because they were fetched for a prototype.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The documented behavior materially broadens the skill from UI design into operational network retrieval and local file creation. This scope expansion is dangerous because an agent may treat the skill as authorization to perform shell commands and ingest remote content, which can be abused to introduce malicious assets, access unintended endpoints, or persist attacker-controlled files in the workspace.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to fetch remote assets via shell commands, expanding a design-guidance skill into network and shell-capable behavior. Even with a note to prefer HTTPS and avoid private hosts, this creates a path for untrusted user-supplied URLs to trigger external downloads, increasing SSRF, supply-chain, and unsafe file-write risk in contexts that do not require such capabilities.

Natural-Language Policy Violations

Low
Confidence
72% confidence
Finding
The instruction says designs must align with 'real iOS/Android design standards,' which constrains output to platform-specific conventions regardless of user preference. Because the file does not present this as an optional choice or justify it as a narrow platform-compliance requirement, it can be interpreted as an undocumented policy-level constraint on output style.

Static analysis

No suspicious patterns detected.