Design Guide

• Outcome: Review
• Latest audit: Aug 8, 2026 · 4:20 PM UTC
• Version: 0.1.2

Overview

This is a broad but coherent frontend design and QA skill whose powerful local preview, browser testing, and sync helpers are disclosed and user-directed.

Install this skill if you want an agent to perform frontend design, implementation, preview, and QA workflows. Treat its helper scripts as powerful local tooling: run preview commands only from trusted projects, expect .codex logs/reports/state files, and use the cross-AIDE sync script only if you are comfortable replacing the managed design-guide directories under your AIDE skill folders.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env = os.environ.copy()
    env["BROWSER"] = "none"
    with log_path.open("ab", buffering=0) as log_file:
        process = subprocess.Popen(
            command,
            cwd=cwd,
            env=env,

• Confidence: 91% confidence
• Finding: process = subprocess.Popen( command, cwd=cwd, env=env, stdin=subprocess.DEVNULL, stdout=log_file, stderr=subprocess.STDO

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill instructs the agent to read and write files, run shell commands, start local servers, and access URLs, yet it declares no permissions. That mismatch can cause users or hosting systems to underestimate the skill's real capability surface, reducing informed consent and weakening policy enforcement around filesystem, shell, and network actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The finding describes behavior beyond frontend design work, including repository scanning for secrets, syncing into multiple AIDE directories, installed-copy auditing, and provider-backed smoke tests that may call external CLIs and consume quota. Those actions expand the operational scope into local environment inspection, persistence, and external side effects, creating a materially broader risk profile than the declared purpose suggests.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: This helper is supposed to manage frontend previews but will execute any local binary and arguments supplied via --command. In an agent skill, that creates a dangerous capability expansion: a user or prompt injection can turn a preview helper into a generic local execution primitive, enabling data theft, system modification, or persistence.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The stop logic will terminate the process identified in the state file if the PID and start marker match, but the state file location is user-accessible and can be replaced or tampered with. That allows the script to act as a process-killing primitive for arbitrary same-user processes, extending beyond preview lifecycle management.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document explicitly excludes mobile and responsive concerns from scope, yet the evidence section evaluates a mobile viewport overflow issue. This creates an inconsistent contract for the skill and can cause downstream agents or reviewers to act on out-of-scope criteria, producing unreliable or misleading review results.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The recommendation to push content to a WeChat draft box introduces a publishing/workflow action that is outside the stated purpose of single-image visual design evaluation. In an agent setting, out-of-scope operational suggestions can trigger unintended actions, scope creep, or unsafe integrations with external platforms.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs `rsync -a --delete --delete-excluded` into several target directories without any confirmation, dry-run, or backup behavior. If `F_DESIGN_TARGET_HOME` is misconfigured, if a target path already contains unrelated data, or if the source tree is incomplete, the command will silently delete files from those target skill directories, causing data loss.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The prompt field uses a very generic image-review request ('评估一下这张图片'), which can easily overlap with ordinary user requests about images and unintentionally trigger this behavior outside its intended scope. In an orchestration skill, overly broad triggers can cause incorrect routing, context leakage across tasks, or inappropriate application of review logic to unrelated requests.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

return 1
    log_path = pathlib.Path(args.log).expanduser().resolve() if args.log else state_path.with_suffix(".log")
    log_path.parent.mkdir(parents=True, exist_ok=True)
    env = os.environ.copy()
    env["BROWSER"] = "none"
    with log_path.open("ab", buffering=0) as log_file:
        process = subprocess.Popen(

• Confidence: 83% confidence
• Finding: os.environ.copy()

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

)

    with tempfile.TemporaryDirectory() as temp_dir:
        env = os.environ.copy()
        env["F_DESIGN_SRC"] = str(ROOT)
        env["F_DESIGN_TARGET_HOME"] = temp_dir
        results.append(run("Journey 3 cross-AIDE sync", ["bash", "scripts/sync-aide.sh"], env=env))

• Confidence: 88% confidence
• Finding: os.environ.copy()

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.install_untrusted_source

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/verify-ui.py:38

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_behavior_evaluations.py:19

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_i18n.py:20

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_quality_pipeline.py:25

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_release_tooling.py:28

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: tests/test_support_scripts.py:23

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: .github/workflows/validate.yml:101

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: tests/fixtures/review-behavior/desktop-url-isolated.json:3