Security audit

Frontman — Visual Frontend Editing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Frontman setup guide whose source-editing and dev-server behavior is disclosed, with supply-chain cautions around unpinned install commands.

Install only in a development project you are willing to modify. Use version control, review dependency and source diffs after setup and each edit, prefer pinned package versions when available, and avoid running the installer in CI or environments containing production secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:37
Finding: Unpinned Third-Party Packages Executed Through Package Runners
Content: View full analysis
Remediation: View remediation
install npx --yes astro@ add @frontman-ai/astro@ npx --yes @frontman-ai/vite@ install ``` 2. Record resolved dependencies in a committed lockfile and require immutable or frozen-lockfile installation in automated environments. 3. Verify package provenance, publisher identity, registry source, and integrity metadata before execution. 4. Review installation scripts and release changes before updating pinned versions. 5. Run installation with least privilege in an isolated development environment without production credentials. 6. Configure trusted registries explicitly and apply dependency monitoring for compromised, deprecated, or unexpectedly transferred packages. 7. Require users to review generated configuration and source changes before committing or deploying them. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrases are broad and overlap with ordinary frontend assistance requests, increasing the chance that the skill activates when the user did not explicitly intend to grant browser and shell-assisted editing behavior. Because this skill can lead to package installation and source-file modification, accidental activation raises the risk of unintended code changes and execution paths.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill prominently advertises that it edits actual source files but does not pair that with a clear warning that local code will be modified and should be reviewed before acceptance. In the context of an AI-driven editing workflow, omission of this warning can cause users to authorize impactful changes without understanding that persistent project files—not temporary overlays—are being changed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The setup and usage sections tell users to run installer commands and use a browser-driven editing loop that changes config and source files, but they do not clearly disclose that these operations will modify the local project. In a development environment, that omission is risky because users may unknowingly permit persistent changes to dependencies, framework config, and application code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run an unpinned npx package, which fetches and executes whatever version is current at invocation time. That creates a supply-chain risk: a compromised upstream release, typo-squatting, or unexpected breaking change could execute arbitrary code on the developer machine during setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx astro add @frontman-ai/astro without pinning versions allows transient resolution of the latest astro CLI and package versions at runtime. If either dependency chain is compromised or a malicious release is published, arbitrary install-time scripts or unsafe project modifications could run on the user's system.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The unpinned npx @frontman-ai/vite install command executes a remote package at its latest published version, which is a classic supply-chain exposure. In a developer environment with local source access, a malicious or compromised release could alter project files, exfiltrate secrets, or run arbitrary code.
Content: No source excerpt is available for this finding.