ClawHub
Back to skill

Security audit

Apple Design Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed design-guidance skill for Apple-style frontend generation, with no evidence of hidden execution, persistence, data theft, or privilege escalation.

Install this skill only if you want Apple-style frontend guidance loaded into your coding assistant. Review the language defaults and third-party font/image behavior for your project, and update the dev dependencies before exposing any local dev or test server.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (39)

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins vitest 3.2.4, and the referenced advisories include arbitrary file read and possible execution when the Vitest UI server is listening, plus the @vitest/mocker traversal issue. Even though this is test tooling, the vulnerability is real and becomes severe if the Vitest UI or related services are run in accessible environments such as shared CI, preview systems, or developer machines exposed on a network.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==3.2.4 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical
Category
Supply Chain
Confidence
97% confidence
Finding

The manifest allows installation of a Vitest version identified as vulnerable to arbitrary file read and possible code execution/path traversal issues. Even though this is a test dependency, such tools are commonly run in developer workstations and CI, where exploitation could expose source code, secrets, or enable malicious execution during testing workflows.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · CLAUDE.md (reported line 688)May include surrounding context.

md
---

## Output Rules

- Always use CSS custom properties (`var(--apple-*)`) — never hard-code raw values.
- Prefer semantic class names (`.hero`, `.product-card`) over utility-only markup.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/pricing-page/output.html (reported line 558)May include surrounding context.

html
</head>
<body>

  <!-- ============================================================
       1. Hero Section — Light variant
       Pattern: Full-Screen Hero (layout-patterns.md §3, light variant)
       Copywriting: Fragment sentence pattern (copywriting.md §2.1)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/feature-showcase/output.html (reported line 8)May include surrounding context.

html
<meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>AirPods Max — Immerse yourself.</title>

  <!-- Google Fonts fallback for environments without Apple system fonts -->
  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/pricing-page/output.html (reported line 8)May include surrounding context.

html
<meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>AirPods Max — Immerse yourself.</title>

  <!-- Google Fonts fallback for environments without Apple system fonts -->
  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/product-landing/output.html (reported line 8)May include surrounding context.

html
<meta name="viewport" content="width=device-width, initial-scale=1.0">
  <title>AirPods Max — Immerse yourself.</title>

  <!-- Google Fonts fallback for environments without Apple system fonts -->
  <link rel="preconnect" href="https://fonts.googleapis.com">
  <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&display=swap" rel="stylesheet">

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High
Category
Supply Chain
Confidence
86% confidence
Finding

The lockfile contains nanoid 3.3.11, and the cited advisories indicate denial-of-service style flaws such as infinite loops or integer overflow in non-secure/custom generator edge cases. This is a real vulnerable version, though exploitability depends on whether the application uses those affected APIs with attacker-influenced size parameters.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
88% confidence
Finding

The lockfile pins postcss 8.5.8, and the listed advisories include arbitrary file read/information disclosure and XSS-related issues. Because PostCSS is often used during build/dev processing of content and source maps, vulnerable parsing or stringify behavior can become dangerous when fed attacker-controlled CSS or mapping inputs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile includes vite 7.3.1, and the cited advisories cover path traversal and arbitrary file read issues in dev server features. In this skill context Vite is a development dependency, which lowers exposure in production, but if any dev server or preview environment is reachable by untrusted users it can leak arbitrary files.

Content

No source excerpt is available for this finding.

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · prompts/layout-patterns.md (reported line 248)May include surrounding context.

md
<div class="apple-content">
    <h2 class="product-grid__heading">Explore the lineup.</h2>
    <div class="product-grid">
      <!-- Card 1 -->
      <article class="product-card">
        <div class="product-card__image">
          <img src="product-1.jpg" alt="MacBook Air — thin and light laptop" loading="lazy">

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · prompts/main.md (reported line 144)May include surrounding context.

};

text

### Output rules

- Always use CSS custom properties for token values so they are easy to override.
- Prefer semantic class names (`.hero`, `.feature-card`) over utility-only markup.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The rule explicitly states that ambiguous Chinese content should default to zh-CN. This forces a specific locale choice without user opt-in and can mis-handle users who intended Traditional Chinese, making it a clear natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The file states support only for English, Chinese, Japanese, and Korean, and instructs automatic language detection. This can violate language/locale policy because users outside those locales are forced into English rather than being offered an explicit opt-in or choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The instructions mandate automatic language inference and specify en as the default fallback. Because no user opt-in or selection step is provided, the skill imposes a locale choice that may not match user preference or organizational language policy.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This file sets the page language to zh-CN and all visible copy is in Chinese, which constitutes a natural-language locale policy constraint. Under the rule, forcing a specific language without user opt-in or documented justification is a policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the agent to apply these rules whenever writing or optimizing headlines, subheadings, or body copy, but it does not define narrow invocation conditions, explicit scoping, or exclusions. That broad trigger can cause the agent to inappropriately rewrite unrelated user content into the Apple-style pattern, increasing the risk of over-application, prompt interference, or unintended behavior in mixed-use conversations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

These lines direct different font weights for English versus CJK text, including a prescriptive statement about achieving the feel of Apple's Chinese site. Because the guidance imposes language-specific styling defaults rather than presenting them as optional or user-selected, it can be interpreted as a locale policy constraint without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This section states that Apple fine-tunes letter spacing by language and instructs readers to apply specific tracking to Chinese and English headings. That is a natural-language locale-specific directive, and the file does not indicate that these settings are optional, user-selected, or limited to a justified region-specific use case.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Section 4 introduces CSS gradient fallbacks for cases where images are unavailable, implying gradients can substitute for missing images. Section 7.3 later directly contradicts this by stating CSS gradients alone are not acceptable as the primary image strategy and that at least one real image is always required.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs consumers to embed third-party Unsplash hotlinks directly into pages, which causes client browsers to contact a third-party domain and disclose user IP address, user-agent, referrer, and timing metadata. In privacy-sensitive deployments, this creates unannounced cross-origin data transfer and external dependency risk, especially if operators assume the skill is self-contained.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file instructs the skill to detect the user's language automatically and apply corresponding language-specific rules. This creates a language/locale policy issue because it enforces locale behavior without explicit user choice, and the text does not offer an opt-in or override mechanism.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instruction says to detect the user's language from their prompt and automatically apply the matching font stack. This imposes a locale/language decision based on inference rather than offering the user a choice or opt-in, which matches the policy's language/locale violation criteria.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

L307 states that all other typographic tokens, including weight, are applied uniformly across languages. This directly contradicts the earlier documented CJK override rules at L247-L275, which require heavier heading weights for zh-CN, zh-TW, ja, and ko.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The quick-reference table summarizes heading weight as 600–700 for all headings, but L247-L275 explicitly mandates 700–900 weights for CJK languages and even provides CSS implementing 800/900 overrides. This is an active contradiction in the file's guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.