Tailwind Config Validator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:14 AM UTC
• Version: 1.0.1

Overview

The validator itself is a local JSON checker, but its instructions can cause users or CI to execute the Tailwind config being reviewed, which is risky for untrusted projects.

Use this skill on Tailwind configs from projects you trust. For third-party or untrusted repositories, avoid running the documented Node export command on your workstation or a secret-bearing CI runner; instead require a pre-generated JSON config or run the export in a locked-down disposable environment with no credentials and no network access.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:10

Finding

Untrusted Tailwind Configuration Execution During JSON Export

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:10-15 and SKILL.md:130-134
Vulnerability Type: Unsafe evaluation of untrusted JavaScript configuration
Risk Level: High

Vulnerable Code

bash

node -e "console.log(JSON.stringify(require('./tailwind.config.js')))" > config.json
python3 scripts/tailwind_config_validator.py validate config.json

The same unsafe workflow is recommended for CI:

yaml

run: |
  node -e "console.log(JSON.stringify(require('./tailwind.config.js')))" > /tmp/tw-config.json
  python3 scripts/tailwind_config_validator.py validate /tmp/tw-config.json --strict --format json

Technical Analysis

Node.js require() does not parse a configuration file as inert data. It evaluates the target JavaScript module and any modules imported by it. Consequently, following the documented export workflow executes all top-level code in tailwind.config.js before the Python validator receives the generated JSON.

If the project being audited is untrusted, an attacker can place arbitrary JavaScript in its Tailwind configuration. That code executes with the privileges and environment of the user or CI runner performing the audit. The Python validator itself only reads and parses JSON and does not introduce this execution behavior; the vulnerability is in the documented prerequisite workflow.

Attack Path

1. An attacker creates or modifies a repository containing a malicious tailwind.config.js.
2. A user or CI pipeline follows the documented command to export that configuration as JSON.
3. Node.js resolves and evaluates tailwind.config.js through require().
4. Malicious top-level code or an imported module executes before JSON serialization.
5. The payload can access the runner's files, environment variables, credentials, and network using the current process privileges.
6. The payload may exfiltrate secrets, alter workspace files, or compromise subsequent buil ...[truncated 661 chars]

Remediation

View remediation

Remediation Suggestions

• Do not evaluate configurations from untrusted repositories directly on a developer workstation or privileged CI runner.
• Require users to supply a pre-generated JSON configuration when the source cannot be trusted.
• Clearly warn that require('./tailwind.config.js') executes arbitrary project code and is safe only for trusted projects.
• If dynamic export is necessary, run it in an ephemeral sandbox or container configured with:
  • No credentials or sensitive environment variables.
  • Network access disabled by default.
  • A non-root user with minimal privileges.
  • A read-only mount for repository input.
  • A separate, narrowly scoped writable output directory.
  • CPU, memory, process, and execution-time limits.
  • No Docker socket, host IPC, SSH agent, cloud metadata, or privileged host mounts.
• Treat the generated JSON as untrusted input and retain the Python validator's existing strict JSON parsing.
• Apply the same isolation requirements to the documented CI example rather than executing repository configuration in a secret-bearing build job.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.