Security audit

gemdesign-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for GemDesign prototyping, but it needs Review because broad design requests can trigger global CLI installation, token-based login, local server/browser actions, and remote syncing.

Install only if you intend to use GemDesign cloud syncing and are comfortable with a global npm CLI, agent-assisted account login, local preview server processes, and uploading prototype requirements/pages/docs to GemDesign. Prefer manually installing and authenticating the CLI outside the agent, avoid sensitive internal/customer data unless approved, and verify any running server or saved app/page before continuing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill directs the agent to install or update a global npm package before doing its core task, which expands its authority beyond UI prototyping into environment modification and software supply-chain actions. This is dangerous because it can change the host system state, pull unreviewed code from the network, and create persistence or compatibility risks unrelated to the user's immediate request.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to solicit a GemDesign token from the user and then use it to authenticate automatically. This is dangerous because it normalizes credential collection inside the agent workflow, exposing sensitive secrets to prompt/tool logs and enabling the agent to act with the user's account privileges.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The skill mandates programmatic browser opening and falls back to OS shell commands like start/open/xdg-open. That is dangerous because it pushes the agent into local application execution and shell-mediated side effects, increasing the blast radius from design automation to host interaction without strong necessity or clear consent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that the skill automatically checks for and installs the CLI on first use, but it does not clearly warn users that invoking the skill may trigger software installation and execution of a local preview server. In an agent-skill context, hidden install-and-run behavior increases supply-chain and local execution risk because users may invoke the skill expecting documentation-only behavior, while the agent may fetch and run external code.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to authenticate with a personal access token and notes syncing to the GemDesign platform, but it does not provide a privacy or data-handling warning about what content may be uploaded, stored, or exposed to the remote service. In this skill's context, generated prototypes may contain sensitive product requirements, mock customer data, or internal designs, so omission of privacy expectations can lead to unintended disclosure.

Vague Triggers

Medium

Confidence: 75% confidence
Finding: The invocation description is broad enough to match ordinary design or page-generation requests without tight constraints, making over-invocation likely. In context, that matters because the skill carries sensitive behaviors such as software installation, authentication handling, local server control, and browser launching, so accidental activation can trigger unnecessary privileged actions.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: The 'When to Invoke' rules are ambiguous and cover common design scenarios, which can cause the skill to activate for routine tasks that do not require its privileged workflow. Because this skill includes auth, filesystem, server, and browser operations, ambiguous activation materially increases the chance of unnecessary sensitive actions.

Ssd 3

High

Confidence: 99% confidence
Finding: This is a direct credential-handling anti-pattern: the agent is told to collect a user's authentication token and immediately use it. In skill context, this is more dangerous than a generic auth mention because it operationalizes secret exfiltration into the agent loop, where tokens may be retained in transcripts, analytics, tool logs, or reused for unintended account actions.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: | 2 | **OS default browser command** | If no built-in browser/preview tool is available (or it failed), open the default browser via OS command: Windows `start http://localhost:<port>/`, macOS `open http://localhost:<port>/`, Linux `xdg-open http://localhost:<port>/`. | | 3 | **Tell the user to open the URL** | If ALL above methods fail or are unavailable, as a **last resort**, clearly tell the user: "请在浏览器中打开 http://localhost:<port>/ 查看设计器预览" and wait for the user to confirm before proceeding. | **How to find your platform's built-in tool:** Check your available tools list — look for tools with names like `OpenPreview`, `browser_navigate`, `preview`, `browser`, or similar. Any tool that can open a URL in a browser panel qualifies. Use it with the URL `http://localhost:<port>/`. **Ensuring success:** - If the highest-priority method returned an error or you're unsure whether it succeeded, immediately fall back to the next method in the table.
Confidence: 78% confidence
Finding: The skill effectively encourages use of any available browser/preview tooling and then OS-level commands as fallback, without a narrow allowlist tied to least privilege. That is dangerous because it teaches the agent to discover and invoke broader tool surfaces opportunistically, which can bypass intended boundaries and increase exposure to host-side side effects.

Static analysis

No suspicious patterns detected.