Aesthete Agent — Frontend Aesthetics, Proof-Tested

• Outcome: Review
• Latest audit: Oct 16, 2026 · 4:16 AM UTC
• Version: 0.4.0

Overview

The skill mostly matches its color-design purpose, but it also includes third-party harvesting guidance, broad file-write behavior, persistent local preference changes, and unpinned executable install paths that deserve review before use.

Install only if you are comfortable with a local color-design tool that can write generated files and update its bundled profile/library. Avoid using the coolors harvesting instructions unless you have permission and have reviewed the site terms; prefer pinned releases or a reviewed local checkout for the MCP server, and keep backups of profile.json and palettes.json if you use the learning/write-back features.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (58)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description centers on color palette generation, color validation, accessibility checks, palette libraries, and related frontend color-analysis features. The supplied code does not generate palettes, analyze colors, compute contrast, simulate color blindness, extract colors from images, or maintain any preference-learning profile. Instead, it builds a side-by-side comparison page for multiple existing HTML files and enforces a workflow rule that at least two candidate pages must be presented for user selection. While this could be tangentially useful in a design-review process, it is not a supporting implementation detail of the described color-analysis engine; it is a materially different utility with a different primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a substantial offline color-analysis and palette-generation system with many specific capabilities. However, the provided code chunk is merely a placeholder test file with a docstring and no functional implementation. Its primary purpose appears to be a regression test skeleton, not color processing or frontend aesthetics. This is a strong description-behavior mismatch because the actual code does not perform, expose, or support the claimed capabilities in any observable way.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · palettes/palettes.json (reported line 4)May include surrounding context.

json

{
 "_meta": {
  "schema": 2,
  "description": "Curated palettes harvested live from coolors.co official order pages (trending/popular/latest, 48 each; style-filter URLs proved to be SEO fallback clones of popular — do not use). tier = crowd signal (3>=50K likes, 2>=20K, 1>0, 0 new/unranked); occurrences = cross-page recurrence; computed_styles from HSL stats; flags from objective gates (CB-COLLISION-RISK / SLOP-SIGNATURE / NARROW-LIGHTNESS). Gates reject only broken architecture, never judge beauty — final judgment happens in context at use time.",
  "harvested": "2026-10-15",
  "counts": {
   "kept": 97,

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document instructs the agent to harvest third-party palette data from coolors.co to expand a local library, which materially exceeds the advertised 'offline' scope of the skill. This creates scope creep into external data acquisition, with legal, compliance, and abuse risks if the agent is later invoked to browse and scrape sites rather than operate on local inputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file provides operational instructions for getting through Cloudflare using a real browser, suppressing site UI via DOM manipulation, and extracting data from a third-party site. Those steps are dangerous because they normalize anti-bot circumvention and scripted scraping behavior unrelated to the core color-design function, increasing the chance the agent is used for unauthorized collection or policy evasion.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute an unpinned package via npx skills add docsor1212/aesthete-agent, which pulls the latest resolver/installer path at execution time. If the skills package or dependency resolution chain is compromised or changes unexpectedly, users could install or run attacker-controlled code from the supply chain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

uvx aesthete-agent-mcp executes the latest published MCP server package without version pinning. Because MCP servers are executable local components that may expose tools to an agent host, a compromised or newly malicious package release could result in arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This installation instruction again references npx skills add docsor1212/aesthete-agent without a fixed version, so behavior depends on whatever package version is current at runtime. That creates a reproducibility and supply-chain risk: a malicious or hijacked upstream release could alter what gets installed or executed on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This repeated uvx aesthete-agent-mcp command has the same issue: it relies on an unpinned package name that resolves to the latest available artifact. In the context of an MCP server, that is more dangerous than a passive dependency because users are being told to run code directly, increasing exposure to package takeover or malicious updates.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs use of shell commands and file reads/writes but does not declare any tool scope or permission boundaries. That creates an overbroad execution surface where a host may grant more capability than the skill actually needs, increasing the risk of unintended file modification or command execution if the skill is invoked in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains very broad phrases like color, contrast, hex, and WCAG-adjacent terminology that may appear in many unrelated tasks. Overbroad invocation can cause the skill to activate unexpectedly, leading to unnecessary shell/file activity or interference with other workflows, especially since the skill includes write-back behavior to local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes natural-language strings that prescribe non-English output tokens or labels without clear user opt-in. While not a direct code-execution issue, forced language behavior can mislead users, break downstream automation that expects a different language, and create integrity problems in generated artifacts or handoff files.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill claims it is 'pure stdlib, offline', but the documented workflow explicitly includes non-stdlib and external-tool dependencies such as Pillow for image extraction and browser/render tooling for validation. This mismatch can cause downstream agents or operators to trust the skill in restricted environments, skip dependency review, or misjudge its execution and supply-chain risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad terms like '配色', '颜色搭配', 'WCAG', and '设计美学', which can cause the skill to activate on loosely related conversations. Over-broad activation increases the chance that the agent overrides more appropriate skills, processes irrelevant user data, or performs unintended actions in workflows where color tooling was not requested.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 65% confidence

Finding

uvx/uv tool run commands without ==version create a rug-pull risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · mcp/server.py (reported line 41)May include surrounding context.

python

"""Run palette_forge.py with args; return (ok, text)."""
    cmd = [sys.executable, ENGINE] + [str(a) for a in args]
    try:
        r = subprocess.run(cmd, capture_output=True, text=True,
                           encoding="utf-8", errors="replace", timeout=timeout)
    except subprocess.TimeoutExpired:
        return False, "engine timeout"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The visualizer tool accepts an arbitrary out path and forwards it to the engine, enabling file writes to user-specified locations without any guardrails in this server layer. In an MCP context, tools may be invoked by an LLM or workflow agent, so unbounded write targets increase the risk of overwriting local files or planting generated content in sensitive paths if the downstream engine writes blindly.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file metadata claims the skill is 'offline' while also stating the palette library was 'harvested live from coolors.co'. That inconsistency can mislead reviewers and users about provenance, reproducibility, licensing, and whether external data access was involved, which weakens trust and supply-chain transparency even if no runtime network call exists in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file contains natural-language instructions and naming that explicitly target Chinese presentation, and multiple theme font stacks are hard-coded to Simplified Chinese fonts. Because the configuration does not offer a language or locale choice or document that it is a region-specific tool, this creates a locale policy issue rather than a purely stylistic choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The theme uses font stacks such as 'Noto Serif SC', 'Source Han Serif SC', 'Songti SC', 'PingFang SC', and 'Microsoft YaHei', which are specific to Simplified Chinese typography. Repeating this pattern across the theme pack indicates an implicit language/locale requirement without user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The notes field is written in Chinese and appears to define the default discourse/register for the user profile. Because this JSON is a manifest/config-type file and no language choice or opt-in is provided, it suggests a fixed locale/language preference that may violate language-policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The reason string states a default user register in Chinese and constrains dark-theme use unless a brief explicitly requests it. This encodes a specific language/locale preference in natural language without any indication of user opt-in or a documented regional requirement.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill reference is written in Chinese and presents its instructions, templates, and operational guidance exclusively in that language. There is no indication that the user may choose another language or that the locale restriction is justified as a region-specific requirement, which creates a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.