Security audit

f-design

Security checks across malware telemetry and agentic risk

Overview

This is a frontend design and implementation skill whose local file, command, preview, and sync behavior is mostly disclosed and aligned with that purpose, though users should treat its cross-AIDE sync script carefully.

Install this if you want an opinionated frontend design and implementation workflow. Before running the AIDE sync command, back up any customized f-design copies because the script mirrors the source and can remove files inside the target f-design folders; use F_DESIGN_TARGET_HOME for a sandboxed test first.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill instructs the agent to read and write project files and execute shell commands, but it declares no permissions or trust boundary for those capabilities. That creates a confused-deputy risk where a user may invoke a 'design' skill without realizing it can inspect the repository, launch processes, and modify files, increasing the chance of unintended local impact.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The advertised role is frontend design orchestration, but the instructions also authorize local environment inspection, cross-directory skill installation/synchronization, and invocation of external CLIs. That mismatch is dangerous because users may consent to a UI task while the agent performs broader host-level actions affecting other tool directories or executing additional binaries they did not reasonably expect.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation instructs users to run a synchronization script that removes files in target mirrors which no longer exist in the source, but the invocation example does not place a clear destructive-action warning directly adjacent to the command. In a skill-installation context, users may copy-paste the command into a real home directory without realizing it performs deletions across multiple tool directories, increasing the chance of accidental data loss or overwriting customized local content.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.