React Design Draft

• Outcome: Pass
• Latest audit: Jun 8, 2026 at 4:41 PM UTC
• Version:
  3.0.0

Overview

This skill is a documentation-only React design-draft generator; its main practical risk is accidental file generation or broad keyword activation, not hidden or malicious behavior.

Install only if you want an agent to help generate React design-draft code from content. Use a fresh or clearly named output directory and confirm the selected layout/style before generation, especially in an existing project, to avoid confusion with existing App.jsx or component files.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The README advertises very broad trigger phrases such as '设计稿', '生成页面', '信息图', and generic requests like turning content into an infographic. In agent platforms, such broad matching can cause unintended invocation on ordinary user requests, leading the skill to generate files or take over workflows when the user did not explicitly intend to use this skill.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README states that the skill outputs multiple files including App.jsx and component files, but it does not warn that these may be created or overwrite existing files in the workspace. In an agent context, users may assume this is a preview-only design operation, while the skill could modify a live project structure and clobber existing code.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The file defines preset activation via broad keyword matching, and the workflow says to apply a preset when the user merely mentions a keyword. In an agent skill, this can cause unintended routing or styling behavior from ordinary phrasing, reducing user control and making prompt interpretation easier to manipulate indirectly.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Many keywords are generic terms such as '报告', '排名', '展示', or 'dark/科技'-style descriptors that can appear in normal requests unrelated to a preset. Because the skill is invoked from natural language, overlapping keywords can trigger the wrong preset and produce unintended outputs, which is a prompt-routing weakness rather than direct code execution.

VirusTotal

64/64 vendors flagged this skill as clean.