ClawHub
Back to skill

Security audit

Ant Design Skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Ant Design UI-building skill with two practical quality and dependency issues to review before reuse.

Installers should treat this as a normal frontend-development skill, but update the starter dependencies before running it and add confirmation, undo, permission checks, loading states, and success/error feedback around any real delete actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The example presents a destructive Delete action with no confirmation dialog, undo flow, or warning, which can normalize unsafe UX patterns and lead developers to implement irreversible deletion directly from a table row. In an admin/data-management context, accidental clicks or keyboard activation could cause unintended data loss, especially because the pattern document is instructional and likely to be reused.

Known Vulnerable Dependency: vite==5.4.10 — 10 advisory(ies): CVE-2025-32395 (Vite has an `server.fs.deny` bypass with an invalid `request-target`); CVE-2025-31125 (Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query); CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling) +7 more

High
Category
Supply Chain
Confidence
98% confidence
Finding
vite==5.4.10

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.