Micro-Frontend Architecture

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:30 AM UTC
• Version: 1.0.0

Overview

This is a micro-frontend guide, but it includes insecure authentication-token and remote-code-loading examples without enough safety guidance.

Review this skill before relying on it for production architecture. If installed, explicitly tell the agent to avoid bearer tokens in localStorage/sessionStorage, avoid passing raw tokens to sub-apps, pin and lock code-generation tools, and require trusted origins, immutable versions, manifest protection, CSP, and integrity checks for remotely loaded micro-frontends.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/qiankun.md:14

Finding

Raw authentication token delegated to independently loaded qiankun sub-applications

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/communication.md:79

Finding

Authentication token stored in script-readable localStorage

Content

View full analysis

{ if (e.key === 'auth_token') handleAuthChange(JSON.parse(e.newValue)); }); ``` A related example delegates access to the same type of storage in `references/single-spa.md:25`: ```js customProps: { authToken: () => localStorage.getItem('token') }, ``` ### Technical Analysis `localStorage` is readable by every script executing under the same origin. It provides no `HttpOnly` protection and persists beyond the lifetime of an individual page. In a micro-frontend architecture, this can include the shell, every same-origin sub-app, dynamically loaded remote modules, and their third-party dependencies. Consequently, any same-origin cross-site scripting issue or compromised remote bundle can retrieve the authentication token without needing to defeat cookie protections. The storage event also distributes authentication-state changes across same-origin tabs, further increasing the number of contexts interacting with the sensitive value. ### Attack Path 1. An attacker exploits an XSS vulnerability or compromises any script, dependency, or remote micro-frontend executing under the application origin. 2. The malicious code calls `localStorage.getItem('auth_token')` or `localStorage.getItem('token')`. 3. The code extracts the bearer token from the returned value. 4. The token is sent to an attacker-controlled endpoint or used directly to call protected APIs. 5. Because the value is persistent, it may remain available after navigation or browser restart until explicitl ...[truncated 386 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/single-spa.md:34

Finding

Runtime remote JavaScript execution without documented integrity controls

Content

View full analysis

{ "imports": { "@org/app-navbar": "https://cdn.example.com/navbar/main.js", "@org/app-home": "https://cdn.example.com/home/main.js", "react": "https://cdn.jsdelivr.net/npm/react@18/umd/react.production.min.js", "react-dom": "https://cdn.jsdelivr.net/npm/react-dom@18/umd/react-dom.production.min.js" } } ``` Related dynamic remote-loading guidance appears in `references/deployment.md:28-36`: ```js async function getRemoteUrl(appName) { const manifest = await fetch('/api/mfe-manifest').then(r => r.json()); const hash = manifest[appName]; // e.g. "a1b2c3d" return `https://cdn.example.com/${appName}/${hash}/remoteEntry.js`; } const url = await getRemoteUrl('appOrders'); const { default: OrderList } = await loadRemote('appOrders', './OrderList', url); ``` The canary example also uses mutable executable aliases in `references/deployment.md:65-71`: ```js function getRemoteVersion(appName, userId) { const isCanary = hash(userId) % 100 < 10; // 10% canary return isCanary ? `https://cdn.example.com/${appName}/canary/remoteEntry.js` : `https://cdn.example.com/${appName}/stable/remoteEntry.js`; } ``` ### Technical Analysis The architecture executes JavaScript obtained from CDNs and URLs resolved at runtime. This behavior is legitimate for micro-frontends, but the examples do not document artifact signatures, Subresource Integrity where applicable, strict origin allowlists, authenticated manifest updates, or a restrictive Content Security Policy. The unversioned SystemJS URL and mutable `stable` or `canary` paths may resolve to different executable content after the Skill has be ...[truncated 1293 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: references/module-federation.md:97

Finding

Unpinned package retrieval and immediate execution through npx

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation presents subscribe as returning a cleanup function, but the code adds an anonymous wrapper listener and later tries to remove the original handler reference. Because removeEventListener must receive the same function object that was registered, the shown cleanup does not actually unsubscribe, contradicting the comment // cleanup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The guide recommends storing an auth token in localStorage and sharing it across sub-apps without warning that web storage is readable by any script running in the origin. In a micro-frontend architecture, the shared-origin model and increased script surface make XSS or compromised sub-app code especially dangerous, because theft of a persisted token can lead to account takeover and session abuse.

Content

No source excerpt is available for this finding.

Cloud Storage Exfiltration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 18)May include surrounding context.

md

- uses: actions/checkout@v4
      - run: cd apps/app-orders && npm ci && npm run build
      - name: Upload to CDN
        run: aws s3 sync dist/ s3://my-mfe-cdn/app-orders/${{ github.sha }}/
      - name: Update manifest
        run: |
          curl -X PATCH https://api.example.com/manifest \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 21)May include surrounding context.

run: aws s3 sync dist/ s3://my-mfe-cdn/app-orders/${{ github.sha }}/ - name: Update manifest run: | curl -X PATCH https://api.example.com/manifest
-d '{"app-orders": "${{ github.sha }}"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 78)May include surrounding context.

run: aws s3 sync dist/ s3://my-mfe-cdn/app-orders/${{ github.sha }}/ - name: Update manifest run: | curl -X PATCH https://api.example.com/manifest
-d '{"app-orders": "${{ github.sha }}"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 21)May include surrounding context.

run: aws s3 sync dist/ s3://my-mfe-cdn/app-orders/${{ github.sha }}/ - name: Update manifest run: | curl -X PATCH https://api.example.com/manifest
-d '{"app-orders": "${{ github.sha }}"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/deployment.md (reported line 78)May include surrounding context.

run: aws s3 sync dist/ s3://my-mfe-cdn/app-orders/${{ github.sha }}/ - name: Update manifest run: | curl -X PATCH https://api.example.com/manifest
-d '{"app-orders": "${{ github.sha }}"}'

text

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation recommends running an unpinned package directly with npx, which fetches and executes the latest published version at runtime. If the package is compromised, typo-squatted, or a breaking/malicious release is published, users following the guide could execute attacker-controlled code on their machine or in CI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The root config passes an authentication token from localStorage into a sub-application via customProps, expanding the token's exposure surface to independently loaded micro-frontends. In a single-spa architecture, sub-apps may be deployed separately and loaded at runtime from CDN origins, so sharing bearer tokens this way increases the risk of token theft or misuse if any sub-app or its supply chain is compromised.

Content

No source excerpt is available for this finding.