Design System Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:27 AM UTC
• Version: 1.0.0

Overview

This is a coherent design-system guide, but it needs review because some examples run mutable third-party tooling and give a mutable CI action access to a project token.

Review and harden the examples before installing or applying this skill: pin package and GitHub Action versions to reviewed releases or commit SHAs, prefer locked devDependencies over unpinned `npx`/`dlx`, pass tokens through scoped secrets or supported environment variables, restrict CI permissions, and avoid `--auto-accept-changes` except for controlled initial baseline setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:174

Finding

Unpinned Storybook Bootstrap Executes Mutable Third-Party Code

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/storybook-setup.md:354

Finding

Unpinned Chromatic CLI Receives a Project Credential

Content

View full analysis

``` `references/testing-strategy.md:257-260`: ```bash # First run — establishes baselines npx chromatic --project-token= --auto-accept-changes # Subsequent runs — diffs against baseline npx chromatic --project-token= ``` ### Technical Analysis These examples invoke Chromatic through `npx` without identifying an exact reviewed package version. If the package is not already installed and pinned locally, `npx` may resolve and execute package code from the configured registry. The executable receives a Chromatic project token directly through a command-line argument. Uploading Storybook artifacts and authenticating to Chromatic are expected parts of the declared visual-regression functionality. Nevertheless, exposing a credential to an executable whose exact version is not fixed creates avoidable supply-chain risk. Passing the credential on the command line can also expose it through shell history, command logging, CI output, or process inspection, depending on the execution environment. The `--auto-accept-changes` option introduces an additional integrity risk if used outside a controlled initial-baseline workflow because compromised or unintended visual output may be approved automatically. There is no evidence that the current Chromatic CLI is malicious or that a real token is embedded in the Skill. The examples use placeholders. The issue is the unsafe execution and credential-handling pattern. ### Attack Path 1. An attacker compromises the Chromatic package publisher, registry account, dependency-resolution path, or the package version selected by `npx` ...[truncated 1212 chars]

Remediation

View remediation

``` - Execute the lockfile-pinned dependency through a package script with `pnpm install --frozen-lockfile`. - Supply the token through Chromatic's supported environment variable or secret-injection mechanism rather than a command-line argument. - Ensure CI logs do not print secret values. - Scope the project token to the minimum permissions available and rotate it periodically. - Do not make the token available to untrusted pull-request workflows. - Restrict `--auto-accept-changes` to a separately controlled baseline-establishment job, and require manual review for normal visual changes. - Run the command in a minimally privileged CI job without unrelated secrets. ]]>

T08 · Insecure Dependencies

Error

• Location: references/storybook-setup.md:374

Finding

Mutable GitHub Action Reference Is Granted a Chromatic Secret

Content

View full analysis

Remediation

View remediation

with: projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }} workingDir: apps/docs ``` - Record the corresponding release version in a comment for maintainability. - Review action updates before changing the pinned SHA. - Define explicit minimal workflow permissions, using read-only access unless additional rights are strictly required: ```yaml permissions: contents: read ``` - Keep unrelated repository and deployment secrets out of the job. - Prevent secrets from being supplied to workflows triggered from untrusted forks. - Use protected environments and required approvals for workflows that access sensitive deployment credentials. - Scope and periodically rotate the Chromatic token. - Use automated dependency-update tooling that proposes reviewed SHA updates rather than following mutable tags. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/testing-strategy.md (reported line 327)May include surrounding context.

md

### Storybook a11y Addon

- Automatically runs axe-core on every story in dev
- Shows violations in the Accessibility panel
- Fails CI when configured:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The documentation instructs users to run npx style-dictionary without pinning a specific package version. npx may fetch the latest published package at execution time, which creates a supply-chain risk: a compromised upstream release or unexpected breaking change could execute unreviewed code on the developer's machine or CI runner. In this skill context, the command is presented as a build step for a frontend/design-system workflow, so users are reasonably likely to copy-paste and run it directly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.