fabrica-design-md

• Outcome: Review
• Latest audit: Sep 17, 2026 · 4:16 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for creating a brand design file, but it has under-scoped privacy handling and a direct exception that allows copying a known brand if the user insists.

Install only if you are comfortable sending brand screenshots or ZIP files through Telegram and storing the resulting DESIGN.md for reuse by other skills. Review the generated DESIGN.md before reuse, do not use the copy-known-brand exception, and approve Playwright/Chromium installation only in a trusted environment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description presents a comprehensive brand design-system skill whose primary purpose is to derive and document a user's brand system from existing materials, including measured contrast and deliverables like DESIGN.md and a test page. The actual code only performs one small supporting function mentioned in the description: measuring WCAG color contrast from command-line color inputs. There is no logic for extracting identity, processing screenshots/web code/interviews, assembling a design system, producing documentation, or creating a preview page. This is therefore a material description-behavior mismatch: the code covers only a narrow subcomponent, not the declared primary capability.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

Usa `references/plantilla-design-md.md`. Guarda en la raíz del proyecto de la persona,

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description lists activation phrases such as "arma mi sistema visual", "crea el archivo de marca", and especially "mis diseños salen genéricos", which are broad conversational statements rather than narrowly scoped commands. Although some examples are specific, the overall trigger definition lacks clear constraints or negative examples beyond one non-use case, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs sending user screenshots, extracted assets, and deliverables over Telegram and storing them in server-side paths without any privacy warning, consent checkpoint, retention rule, or sensitivity screening. In an agent/server setting this creates a real data-handling risk because brand assets, private repos, and possibly logged-in captures may contain confidential or personal information and are being moved across third-party channels.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill first says it does not copy another brand's system, then later instructs the agent to do so if the user insists. This undermines a stated safeguard and can facilitate IP infringement, brand impersonation, and generation of deceptive materials that mimic a known company.

Content

No source excerpt is available for this finding.

Ssd 1

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Authorizing the agent to copy a known brand system if the user insists defeats the skill's own anti-copying control and normalizes imitation of recognizable branding. That can enable deceptive branding, copyright/trade-dress misuse, and reputational harm to both users and platform operators.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs use of npx playwright/npx playwright install chromium without pinning a specific version, which can fetch whatever package version is current at execution time. In an agent/server context this creates supply-chain and reproducibility risk, especially because installation may pull code and binaries from the network onto the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest explicitly says the skill is not for accessibility auditing, yet the workflow optionally invokes web-design-guidelines on the output page. Even though this is applied to the generated prueba.html rather than an existing user page, it introduces an accessibility/design-audit step that goes beyond the narrowly stated extraction-and-delivery purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing output strings are written only in Spanish, which imposes a specific language on users without opt-in or configuration. This matches the policy category for language or locale constraints because the file does not offer an alternative language or document a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a code file, so safety-relevant file writes should have some user disclosure such as a confirmation, explicit warning comment, or user-facing notice. Although the script usage is documented, there is no direct warning near the screenshot write that image files will be created in the specified path.

Content

No source excerpt is available for this finding.