ClawHub
Back to skill

Security audit

custom-ui-spec

Security checks for vulnerabilities and agentic risk

Overview

This skill is a UI design guidance and validation aid, with no evidence of hidden data access, persistence, or unsafe behavior.

This skill is appropriate for users who want UI design-system guidance and local validation. Be aware that the validator can read files you explicitly pass to it, so use it on UI source files you intend to analyze.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (33)

Ae1

High
Category
analysis-evasion
Content
4. Run `scripts/validate_ui.py` for automated validation
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
4. Run `scripts/validate_ui.py` for automated validation
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
4. Run `scripts/validate_ui.py` for automated validation
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
4. Run `scripts/validate_ui.py` for automated validation
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Hidden Instructions

High
Category
Prompt Injection
Content
</head>
<body>
  <div class="app-shell">
    <!-- Sidebar -->
    <aside class="sidebar">
      <div class="sidebar-header">
        <div class="logo"><span class="logo-dot"></span> ProjectHub</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Main -->
    <div class="main-area">
      <!-- Toolbar -->
      <header class="toolbar">
        <span class="toolbar-title">Overview</span>
        <button class="toolbar-btn" onclick="showToast()">&#128276;</button>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- Team Table -->
        <div class="section-block">
          <div class="section-header">
            <h2>Team Members</h2>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 3. Upload -->
        <div class="section-block">
          <div class="section-header"><h2>Upload</h2></div>
          <div class="upload-zone" id="upload-zone" onclick="document.getElementById('upload-input').click()">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 5. Alert/Banner -->
        <div class="section-block">
          <div class="section-header"><h2>Alert / Banner</h2></div>
          <div class="alert alert-info">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 7. Pagination -->
        <div class="section-block">
          <div class="section-header"><h2>Pagination</h2></div>
          <div class="pagination" id="pagination-demo">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 11. Timeline -->
        <div class="section-block">
          <div class="section-header"><h2>Timeline</h2></div>
          <div class="timeline-vertical">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</head>
<body>
  <div class="app-shell">
    <!-- Drawer -->
    <aside class="drawer">
      <div class="drawer-header">
        <div class="logo"><span class="logo-icon"></span> ProjectHub</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Main -->
    <div class="main-area">
      <!-- Top App Bar -->
      <header class="top-app-bar">
        <button class="menu-btn" onclick="alert('Mobile navigation drawer — use Drawer component in production')">&#9776;</button>
        <span class="top-app-bar-title">Dashboard</span>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- Tabs + Recent Tasks -->
        <div class="section-block">
          <div class="section-header">
            <h2>Recent Tasks</h2>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- Data Table -->
        <div class="section-block">
          <div class="section-header">
            <h2>Team Members</h2>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 5. Alert / Banner -->
        <div class="comp-section">
          <h3>Alert / Banner</h3>
          <div class="mat-space-v md">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 7. Pagination -->
        <div class="comp-section">
          <h3>Pagination</h3>
          <div class="pagination" id="pagination1">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 12. Timeline -->
        <div class="comp-section">
          <h3>Timeline</h3>
          <div class="timeline">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 14. Divider -->
        <div class="comp-section">
          <h3>Divider</h3>
          <div class="mat-space-v sm">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</head>
<body>
  <div class="app-shell">
    <!-- Sidebar -->
    <aside class="sidebar">
      <div class="sidebar-header">
        <div class="logo"><span class="logo-icon"></span> ProjectHub</div>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
<!-- Main -->
    <div class="main-area">
      <!-- Breadcrumb -->
      <div class="breadcrumb">
        <a href="#">Home</a>
        <span class="breadcrumb-sep">/</span>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- Pivot Tabs + Recent Tasks -->
        <div class="section-block">
          <div class="section-header">
            <h2>Recent Tasks</h2>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- Data Grid -->
        <div class="section-block">
          <div class="section-header">
            <h2>Team Members</h2>
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 6. Pagination -->
        <div class="comp-section">
          <div class="comp-section-title">6. Pagination</div>
          <div class="comp-demo">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High
Category
Prompt Injection
Content
</div>
        </div>

        <!-- 11. Timeline -->
        <div class="comp-section">
          <div class="comp-section-title">11. Timeline</div>
          <div class="comp-demo">
Confidence
70% confidence
Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Static analysis

No suspicious patterns detected.