Security audit

Prototype

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate HTML prototype generator, but it can turn untrusted text inputs into executable browser code in generated prototypes.

Install only if you will use it with trusted prototype text and trusted source HTML. Before opening, sharing, or hosting generated bundles, review or sanitize the output, especially titles, body text, selectors, navigation targets, and any imported pages. Avoid hosting generated files under an origin that has sensitive authenticated data unless the inputs are controlled.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:139
Finding: Stored HTML and Script Injection Through Unescaped Prototype Content
Content: View full analysis

${name}

Content for ${name} section.
HTML } ``` ```bash cat < ${name} ${theme_vars} * { margin: 0; padding: 0; box-sizing: border-box; } body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: var(--bg); color: var(--text); line-height: 1.6; } a { transition: color 0.2s; } a:hover { color: var(--primary); } button { transition: background 0.2s; } button:hover { background: var(--primary-hover) !important; } ${body} HTMLDOC ``` ```bash button) local label="${title:-Click Me}" local bg_color="#4a90d9" [[ "$variant" == "secondary" ]] && bg_color="#6c757d" [[ "$variant" == "danger" ]] && bg_color="#dc3545" [[ "$variant" == "success" ]] && bg_color="#28a745" html="${label}" ;; modal) title="${title:-Modal Title}" body_text="${body_text:-Modal content goes here.}" IFS=',' read -ra actions <<< "${actions_str:-cancel,confirm}" local action_buttons="" for action in "${actions[@]}"; do action="$(echo "$action" | xargs)" local abg="#4 ...[truncated 2929 chars]
Remediation: View remediation
`, `"`, and `'`. 2. Apply escaping to every value inserted into HTML text or attribute contexts, including names, titles, body text, section names, labels, and actions. 3. Do not use one generic escaping routine for all contexts; HTML text, HTML attributes, CSS, URLs, and JavaScript strings require different handling. 4. If rich HTML is intentionally supported in component bodies, process it through a proven allowlist-based HTML sanitizer rather than writing it directly. 5. Remove inline JavaScript event handlers where practical and attach behavior from static scripts. 6. Add a restrictive Content Security Policy to generated documents, preferably disallowing inline scripts and inline event handlers. 7. Add regression tests using payloads containing closing tags, event handlers, quotes, and script elements, and verify that they are rendered as text rather than executed. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:399
Finding: Arbitrary JavaScript Injection in Generated Navigation Scripts
Content: View full analysis
local nav_script nav_script=$(cat < SCRIPT ) ``` ### Technical Analysis The `--selector` and `--to` values are inserted directly between single quotes in an inline JavaScript program. Neither value is validated nor safely serialized as a JavaScript string. A value containing a quote can terminate the intended string literal and append arbitrary JavaScript statements. The resulting payload is persistent because the complete script is written into the file supplied through `--from`. Injection through `--selector` can execute during the `DOMContentLoaded` callback, while injection through `--to` can alter the event-handler code and execute when the selected element is clicked. The issue is not prevented by shell quoting: the here-document expands variables before writing the generated JavaScript, and browser parsing occurs later. ### Attack Path 1. An attacker supplies a crafted `--selector` or `--to` argument containing a JavaScript string terminator and additional statements. 2. The `link` command embeds the argument into `nav_script` without encoding. 3. The script is inserted before the closing `` tag of the selected HTML file. 4. A user opens the modified prototype. 5. The injected code executes on document loading or after interaction with the linked element. 6. The payload runs with the same browser-origin permissions as the prototype. ### Impact Assessment The attacker ca ...[truncated 299 chars]
Remediation: View remediation
` sequences, and navigation schemes such as `javascript:`. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:344
Finding: CSS Context Breakout Through Unvalidated Animation Arguments
Content: View full analysis
local inject_css="\n ${keyframes}\n ${anim_rule}" ``` ```bash local content content="$(cat "$input")" if echo "$content" | grep -q '</head>'; then content="${content//<\/head>/${inject_css} <\/head>}" else # No head tag, prepend content="${inject_css} ${content}" fi echo "$content" > "$output" ``` ### Technical Analysis The animation name is restricted by a `case` statement, but `--selector` and `--duration` remain unrestricted and are concatenated into a CSS rule. The generated rule is then placed in a `<style>` element and injected into an existing HTML document. An attacker can manipulate stylesheet structure with crafted selector or duration values. More critically, a value containing an HTML style-closing sequence can terminate the generated `<style>` element and introduce arbitrary markup or script into the output document. The resulting payload is stored in the output HTML and activates when the document is viewed. ### Attack Path 1. An attacker controls or influences the `--selector` or `--duration` argument passed to `animate`. 2. The argument contains CSS-breaking syntax or a closing style tag followed by malicious HTML. 3. The command constructs `anim_rule` without validation or encoding. 4. The generated content is inserted before `</head>` or prepended to the document. 5. A user opens the modified HTML file. 6. The browser leaves the intended CSS context and parses the injected content as executable HTML or script. ### Impact Assessment Exploitation can provide arbitrary JavaScript execution in the generated prototype's browser origin. Pure CSS injection can also modify page visibility, overlay dec ...[truncated 183 chars]
Remediation: View remediation
` element is always explicitly and correctly closed. 6. Avoid treating generic command-line input as trusted merely because it is shell-quoted. 7. Add regression tests for CSS rule termination, braces, semicolons, quotes, newlines, and `` breakout payloads. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/script.sh:500
Finding: Stored HTML Injection in Exported Prototype Bundle Metadata
Content: View full analysis
\K[^<]+' "$page" 2>/dev/null || echo "$rel")" local active="" [[ $idx -eq 0 ]] && active=" active" tabs_nav+="${page_title}" ``` ```bash cat < ${title} ``` ```bash
${tabs_nav}
${tabs_content} BUNDLE ``` ### Technical Analysis The export command places the command-line `--title` value directly inside the bundle's `` element. It also extracts titles from source pages and inserts them into tab-button text without HTML escaping. A malicious export title can close the surrounding title element and inject arbitrary markup. Extracted page titles are somewhat constrained by the regular expression, which stops at `<`, but characters such as `&` are still not encoded correctly for safe HTML output. In addition, source body content is intentionally copied into the exported bundle without sanitization, meaning exporting untrusted prototype files preserves any active content they contain. ### Attack Path 1. An attacker supplies a crafted `--title` value, or provides an untrusted prototype directory containing active HTML. 2. The export command reads the pages and builds the bundle using direct st ...[truncated 651 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

${name}

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Static analysis