ClawHub
Back to skill

Security audit

AIOZ UI V3 Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only UI design-system skill with minor scoping and consistency issues but no hidden execution, credential use, or destructive behavior.

Install only if you want Codex to prefer AIOZ UI V3 conventions for React UI work. Be aware that it may activate for broad chart/icon/styling tasks, and review generated dependency or config edits before applying them to projects that are not already using AIOZ UI.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says to use this skill for essentially any task involving AIOZ UI components, styling, icons, charts, or Figma translation, with no meaningful exclusions or scoping boundaries. Overly broad activation can cause the agent to invoke this skill in unrelated or only partially related contexts, increasing the chance of unsafe instruction routing, prompt hijacking via adjacent design content, or inappropriate code transformations.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
**Input:** Figma MCP `name` field on a symbol/instance node
**Output:** React component to use

| Figma Node Name Pattern | React Component   | Import                                                                                                                      |
| ----------------------- | ----------------- | --------------------------------------------------------------------------------------------------------------------------- |
| `Button/*`              | `Button`          | `import { Button } from '@aioz-ui/core-v3/components'`                                                                      |
| `Fields/*`              | `Input`           | `import { Input } from '@aioz-ui/core-v3/components'`                                                                       |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The frontmatter explicitly instructs the agent to read this file whenever it needs to build any chart, graph, or data visualization, which is broader than the narrowly scoped AIOZ UI chart reference. In an agentic system, such broad triggering can cause this skill to activate for unrelated visualization tasks and steer outputs toward this package or design system unexpectedly, creating prompt-scope hijacking and incorrect dependency selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

L2126 states V2 only, but the file manifest, title, and all imports consistently reference AIOZ UI V3 and @aioz-ui/core-v3/components. This directly contradicts the actual intent and content of the file rather than merely omitting detail.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation at L2129 says to never use raw classes like text-sm or font-medium in isolation, yet multiple examples elsewhere use text-sm, font-medium, and similar raw typography classes directly (for example L0223, L0461, L1194-L1195). This is an active contradiction between the file's stated guidance and its example code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Storybook title map at L2136 lists entries such as UI/Button V2, which conflicts with the manifest description and the rest of the file documenting AIOZ UI V3 components. This is a documentation-level contradiction about the versioned intent of the referenced components.

Content

No source excerpt is available for this finding.