fabrica-design-md

• Outcome: Review
• Latest audit: Sep 17, 2026 · 4:16 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for creating a brand design file, but it has under-scoped privacy handling and a direct exception that allows copying a known brand if the user insists.

Install only if you are comfortable sending brand screenshots or ZIP files through Telegram and storing the resulting DESIGN.md for reuse by other skills. Review the generated DESIGN.md before reuse, do not use the copy-known-brand exception, and approve Playwright/Chromium installation only in a trusted environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The description presents a comprehensive brand design-system skill whose primary purpose is to derive and document a user's brand system from existing materials, including measured contrast and deliverables like DESIGN.md and a test page. The actual code only performs one small supporting function mentioned in the description: measuring WCAG color contrast from command-line color inputs. There is no logic for extracting identity, processing screenshots/web code/interviews, assembling a design system, producing documentation, or creating a preview page. This is therefore a material description-behavior mismatch: the code covers only a narrow subcomponent, not the declared primary capability.

Ae1

High

• Category: analysis-evasion

Content

Usa `references/plantilla-design-md.md`. Guarda en la raíz del proyecto de la persona,

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The manifest description lists activation phrases such as "arma mi sistema visual", "crea el archivo de marca", and especially "mis diseños salen genéricos", which are broad conversational statements rather than narrowly scoped commands. Although some examples are specific, the overall trigger definition lacks clear constraints or negative examples beyond one non-use case, increasing the chance of unintended invocation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs sending user screenshots, extracted assets, and deliverables over Telegram and storing them in server-side paths without any privacy warning, consent checkpoint, retention rule, or sensitivity screening. In an agent/server setting this creates a real data-handling risk because brand assets, private repos, and possibly logged-in captures may contain confidential or personal information and are being moved across third-party channels.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill first says it does not copy another brand's system, then later instructs the agent to do so if the user insists. This undermines a stated safeguard and can facilitate IP infringement, brand impersonation, and generation of deceptive materials that mimic a known company.

Ssd 1

Medium

• Confidence: 93% confidence
• Finding: Authorizing the agent to copy a known brand system if the user insists defeats the skill's own anti-copying control and normalizes imitation of recognizable branding. That can enable deceptive branding, copyright/trade-dress misuse, and reputational harm to both users and platform operators.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs use of `npx playwright`/`npx playwright install chromium` without pinning a specific version, which can fetch whatever package version is current at execution time. In an agent/server context this creates supply-chain and reproducibility risk, especially because installation may pull code and binaries from the network onto the host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Description-Behavior Mismatch

Low

• Confidence: 77% confidence
• Finding: The manifest explicitly says the skill is not for accessibility auditing, yet the workflow optionally invokes `web-design-guidelines` on the output page. Even though this is applied to the generated `prueba.html` rather than an existing user page, it introduces an accessibility/design-audit step that goes beyond the narrowly stated extraction-and-delivery purpose.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The module docstring and all user-facing output strings are written only in Spanish, which imposes a specific language on users without opt-in or configuration. This matches the policy category for language or locale constraints because the file does not offer an alternative language or document a justified region-specific limitation.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: This is a code file, so safety-relevant file writes should have some user disclosure such as a confirmation, explicit warning comment, or user-facing notice. Although the script usage is documented, there is no direct warning near the screenshot write that image files will be created in the specified path.

Static analysis

No suspicious patterns detected.