ClawHub
Back to skill

Security audit

Design Guide V12 87WK91

Security checks for vulnerabilities and agentic risk

Overview

This frontend design skill has broad local development powers, but the inspected behavior is disclosed, task-aligned, and user-directed.

Install only if you want an agent to actively work on frontend code, run local dev/QA commands, and manage preview servers. Treat the optional sync script as an overwrite operation for the listed design-guide skill directories, and avoid running preview commands in untrusted repositories with sensitive environment variables loaded.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

The script launches a user-supplied preview command via subprocess.Popen. Although it avoids a shell, this still provides arbitrary code execution capability to anyone who can influence --command, which is significant in an agent skill context because the skill may be induced to run untrusted project commands with inherited environment and filesystem access.

Content

Scanner excerpt · scripts/run-preview.py (reported line 228)May include surrounding context.

python
env = os.environ.copy()
    env["BROWSER"] = "none"
    with log_path.open("ab", buffering=0) as log_file:
        process = subprocess.Popen(
            command,
            cwd=cwd,
            env=env,

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to read project files, execute shell commands, start local servers, write contracts, and inspect environment-derived configuration, yet it declares no permissions boundary. That mismatch can cause hosts or users to treat the skill as passive documentation when it actually drives privileged actions over the filesystem, shell, and network-exposed previews.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README instructs users to run a sync script that treats target skill directories as managed mirrors and explicitly states it will delete outdated files, but the usage guidance does not foreground the destructive nature with a clear warning or require a dry-run/confirmation step. In a multi-tool local environment, this can lead to unintended loss of local customizations or files if users misunderstand the mirror semantics or misplace the source/target directories.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script performs rsync -a --delete --delete-excluded into multiple per-user skill directories, which will remove files in the destination that are not present in the source or are now excluded. Although the targets are fixed and there is a guard against syncing into a subdirectory of the source, there is no dry-run, prompt, or explicit warning before destructive deletion, so a mis-set F_DESIGN_TARGET_HOME or an unexpected target state can cause unintended data loss.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
89% confidence
Finding

The preview process inherits a full copy of the parent environment via os.environ.copy(). In an agent or developer environment this can leak API keys, tokens, proxy credentials, and other sensitive variables to untrusted build/dev server commands started from the workspace, which is especially relevant for a frontend orchestration skill expected to run project code.

Content

Scanner excerpt · scripts/run-preview.py (reported line 225)May include surrounding context.

python
return 1
    log_path = pathlib.Path(args.log).expanduser().resolve() if args.log else state_path.with_suffix(".log")
    log_path.parent.mkdir(parents=True, exist_ok=True)
    env = os.environ.copy()
    env["BROWSER"] = "none"
    with log_path.open("ab", buffering=0) as log_file:
        process = subprocess.Popen(

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
79% confidence
Finding

The code clones the full parent process environment and passes it to a shell script, which can unintentionally forward sensitive tokens, credentials, proxy settings, or dangerous loader/path variables into downstream tooling. In a build or agent environment, this increases the blast radius if the called script or any child process logs, exfiltrates, or misuses inherited secrets.

Content

Scanner excerpt · scripts/verify-product-journeys.py (reported line 83)May include surrounding context.

python
)

    with tempfile.TemporaryDirectory() as temp_dir:
        env = os.environ.copy()
        env["F_DESIGN_SRC"] = str(ROOT)
        env["F_DESIGN_TARGET_HOME"] = temp_dir
        results.append(run("Journey 3 cross-AIDE sync", ["bash", "scripts/sync-aide.sh"], env=env))

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/verify-ui.py:38