Design Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 1.0.0

Overview

This design helper is mostly coherent, but it tells agents to run an unpinned third-party npx command and to invoke itself broadly across visual workflows, which deserves review before use.

Review this skill before installing. It appears intended for legitimate design assistance, but only run the typeui.sh commands if you trust and pin the package version or execute them in a restricted environment. Make sure agents ask before creating DESIGN.md files or invoking this helper automatically across unrelated visual tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:104

Finding

Unpinned Third-Party Package Download and Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20 and 104–107
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

markdown

| [typeui.sh](https://www.typeui.sh) | `npx typeui.sh pull [style]` — CLI, 57+ design skills |

bash

npx typeui.sh pull minimal    # clean typographic
npx typeui.sh pull editorial  # magazine/longform
npx typeui.sh pull brutalist  # high contrast, raw
npx typeui.sh pull luxury     # dark, gold accents

Technical Analysis

The Skill instructs an agent or user to execute typeui.sh through npx without specifying an audited package version, integrity hash, lockfile, or trusted local package source.

When the package is not already installed locally, npx can retrieve it from the configured package registry and execute its current published version. Consequently, the code executed at invocation time may differ from the code that existed when this Skill was audited. Package lifecycle scripts and the package CLI run with the privileges of the invoking process.

This creates a supply-chain trust boundary in which compromise of the package, its publisher account, the registry resolution path, or the configured package registry could result in arbitrary local code execution.

Attack Path

1. An attacker compromises the typeui.sh package, its publisher account, or an applicable package registry and publishes a malicious version.
2. A user or agent follows the instructions in SKILL.md and invokes one of the unversioned npx typeui.sh pull ... commands.
3. npx resolves and downloads the mutable package version from the configured registry.
4. Malicious package lifecycle scripts or CLI code execute with the invoking process's permissions.
5. The malicious code can access files, environment variables, credentials, network resources, and project content available to that process.

Impact Assessment

Successful exploitation permits arbitrary code ex ...[truncated 767 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a specifically reviewed version rather than resolving the latest release:

   bash

   npx --yes typeui.sh@<audited-version> pull minimal
   

2. Record and verify package integrity through a lockfile and an approved package manager workflow. Prefer installation with immutable lockfile enforcement, such as npm ci, over ad hoc downloads during Skill execution.

3. Review the pinned package, its transitive dependencies, executable entry points, and lifecycle scripts before approving it.

4. Prefer a vendored, locally reviewed implementation when feasible. Include its checksum and provenance in the project.

5. Configure an allowlisted registry and verify the exact package identity to reduce dependency-confusion and registry-redirection risks.

6. Execute the CLI in a restricted sandbox or disposable container with:

   • No unnecessary credentials or secrets.
   • Read-only access outside the target output directory.
   • Minimal filesystem permissions.
   • Restricted outbound network access.
   • No administrative privileges.

7. Update SKILL.md to warn that the command executes third-party code and require explicit user approval before downloading or running it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad (make it look better, improve the UI, add design context) and is designed to be called by other skills. Over-broad activation increases the chance the skill will be invoked in unrelated contexts, causing untrusted external design-fetching workflows or mandatory review loops to run when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users or downstream agents to run npx typeui.sh without pinning an exact package version or verifying provenance. Because npx fetches and executes remote code, a compromised package, typo-squatted dependency, or unexpected upstream update could lead to arbitrary code execution in the agent or developer environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This example command tells the user/agent to execute npx typeui.sh pull minimal without version pinning. That creates a supply-chain execution path where remote package contents can change over time and be executed with the privileges of the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This line repeats the unpinned npx execution pattern for the editorial style. Repetition increases the likelihood that downstream agents or users will blindly execute remote code, making supply-chain compromise more plausible in practice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This command again uses npx typeui.sh without an exact version, allowing arbitrary upstream changes to affect what code is run. In an agent skill context, such instructions are especially risky because automation may execute them without human scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The luxury-style example preserves the same unsafe pattern of executing a remotely resolved package through npx without pinning. If the upstream package or one of its dependencies is compromised, this could result in arbitrary code execution and credential or workspace theft.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The statement that any skill generating visual output should check whether design-agent is needed creates an overly broad activation boundary. In a multi-skill system, this can lead to pervasive and unintended invocation, making behavior less predictable and potentially causing unnecessary access to content, extra instructions, or side effects unrelated to the user's specific request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guidance tells other skills to invoke design-agent whenever a user asks to improve, style, or beautify visual output, or on the first generation of HTML/React/PDF. That trigger is broad enough to cause automatic cross-skill invocation in many normal workflows, increasing the chance of unnecessary prompt/context expansion, unintended file-writing behavior downstream, and reduced user control over when the skill is used.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description explicitly includes the Chinese phrase "UI美化 (UI beautification)" as a trigger, while the rest of the document does not explain language selection or offer multilingual opt-in. This can create inconsistent language-policy behavior by implicitly privileging a specific language trigger without documenting user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation directs calling skills to write a DESIGN.md file into the project directory, but it does not require explicit user awareness or approval before modifying files. Even though the file is benign in purpose, instructing agents to create project files by default can produce unauthorized workspace changes and surprises in environments where file modifications are sensitive.

Content

No source excerpt is available for this finding.