Produce thoughtful, well-crafted design artifacts (slide decks, interactive prototypes, hi-fi mockups, animated videos, landing pages, dashboards, marketing one-pagers) using HTML/CSS/JS/SVG as the medium. Use this skill whenever the user asks to "design", "mock up", "prototype", "make a deck", "make slides", "make a landing page", "create a dashboard", "visualize X", "build a UI", "build an interactive demo", or any request whose deliverable is a visual artifact rather than production code. Also trigger for requests like "recreate this UI", "explore options for X", "give me variations of Y", or when the user attaches screenshots/Figma/PRDs and wants a visual response. HTML is the tool; the medium varies — embody the right expert (slide designer, UX designer, animator, prototyper) for the task

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

The skill mainly creates design artifacts, but its prototype guidance can add remote scripts and AI calls without clear user warnings.

Review generated HTML before sharing or opening it with realistic data. In particular, avoid sensitive data in prototypes that use localStorage, remove or pin third-party CDN scripts with integrity checks, and do not use browser-side LLM helpers unless users understand what text may be sent to the host AI service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/react-setup.md:147

Finding

Third-Party Browser Scripts Are Loaded Without Immutable Versioning or Integrity Verification

Content

View full analysis

``` `references/animated-video.md:40`: ```markdown The `animations.jsx` starter handles 90% of cases. Reach for Popmotion (`https://unpkg.com/popmotion@11.0.5/dist/popmotion.min.js`) only when you need: ``` `references/prototypes.md:94`: ```markdown - **Popmotion** (`https://unpkg.com/popmotion@11.0.5/dist/popmotion.min.js`) is a fallback when you need spring physics or complex tweens. ``` ### Technical Analysis The Skill recommends loading executable JavaScript directly from third-party CDNs. The Popmotion URL is pinned to a specific version, but no Subresource Integrity value is supplied. The Lucide URL uses the mutable `@latest` alias, and the Tailwind CDN URL is neither version-pinned nor protected with Subresource Integrity. When these recommendations are used in generated HTML, the browser executes the CDN response in the security context of the resulting page. A compromised CDN, compromised upstream package, mutable release tag, or unauthorized modification of the hosted asset could therefore change the code that is executed after the Skill package has already been reviewed. This also conflicts with the safer practice documented earlier in `references/react-setup.md`, where React, ReactDOM, and Babel are pinned and supplied with integrity hashes. ### Attack Path 1. A user asks the Agent to create a prototype or animated design. 2. The Agent follows the affected reference documentation and includes one of the recommended CDN script URLs in the ge ...[truncated 1362 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

- `deck_stage.js` — Slide deck shell web component (scaling, keyboard nav, slide counter, localStorage, print-to-PDF)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/react-setup.md (reported line 38)May include surrounding context.

md

<meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>Prototype</title>
  <!-- any fonts / CSS -->
  <style>
    body { margin: 0; font-family: system-ui, sans-serif; }
    #root { min-height: 100vh; }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation description is extremely broad, including generic phrases like 'design', 'visualize X', 'build a UI', and catch-all language for any visual artifact request. This can cause the skill to be invoked in situations outside its intended scope, increasing the chance it overrides more appropriate skills or processes sensitive attachments and codebases unnecessarily.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance explicitly encourages prototypes to invoke a host-provided LLM helper directly from browser code, which expands the skill from visual prototyping into model-backed data handling. In a prototype context, this can lead authors to send user-entered or sensitive demo content to an external/host AI service without authentication, consent, data-classification checks, or clear trust boundaries, making prompt/data exfiltration and unsafe feature normalization more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The browser-side example promotes sending arbitrary text to a host-provided AI helper without warning users that their input may be transmitted off-page to a platform service. In a design/prototype skill, this is especially risky because prototypes often collect realistic sample feedback, messages, or customer data, so authors may unknowingly build demos that leak sensitive content to an LLM backend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document strongly requires pinned CDN URLs with integrity, but later recommends third-party scripts without SRI and includes an unpinned @latest dependency. That inconsistency can lead users to execute tampered or unexpectedly changed remote code in the browser, undermining the very supply-chain protections the document claims to enforce.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference encourages loading executable third-party browser scripts directly from CDNs without warning that this runs external code with the page's full privileges. In a design/prototyping skill, users may copy-paste examples into local or shared artifacts, increasing exposure to supply-chain compromise or unexpected upstream behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file explains that starter files are 'installed' into the user's project, which is a file-writing operation that affects user data. While the behavior is part of the skill's purpose, the README does not explicitly warn users that using the skill may create or copy files into their workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The documentation instructs the agent to use a cp command to copy starter assets into the project, which is both shell execution and file modification. The README lacks an explicit caution that this operation changes the local workspace and should be reviewed or confirmed by the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file instructs authors to persist prototype flow state to localStorage by default, but gives no warning that browser localStorage is durable, readable by any script on the same origin, and inappropriate for sensitive content. In isolation this is low severity, but it normalizes client-side persistence without data minimization or disclosure, which can expose form contents or workflow state in shared/demo environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The sample HTML sets the document language to English explicitly, which is a locale choice embedded in natural-language-related configuration. The file does not indicate that this is merely an example to be adapted, nor does it offer user opt-in or a justification for enforcing English.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill is described as producing visual artifacts in HTML/CSS/JS/SVG, but this reference recommends publishing components as globals via Object.assign(window, ...). While workable for prototypes, mutating window expands code visibility and inter-script interaction in a way that is not inherently required for creating mockups or decks, and it introduces unnecessary ambient capability compared with keeping components file-local or bundling them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.