Frontend Builder

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:14 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for frontend code generation, but its setup path tells users to run unpinned remote CLI installs and a broad update of all installed skills.

Install only after reviewing or pinning the ClawHub and shadcn CLI versions. Avoid running `update --all` from this skill unless you intend to update every installed skill and have reviewed those updates. The skill itself is not showing malicious behavior, but its default setup commands create avoidable supply-chain and broad-update risk.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Execution of Unpinned Third-Party CLI Packages and Skill Updates

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-30, 36, and 61-62
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

bash

npx -y clawhub@latest install frontend-design-ultimate
npx -y clawhub@latest install shadcn-ui
npx -y clawhub@latest install react-expert
npx -y clawhub@latest update --all

bash

npx -y clawhub@latest list

bash

npx shadcn@latest init
npx shadcn@latest add card button badge tabs table sheet sidebar

Technical Analysis

The documented setup workflow instructs users or agents to execute npm packages through npx using the mutable latest tag. The -y option also suppresses the interactive installation confirmation for the ClawHub commands.

An npx invocation can download and execute package code, including CLI entry points and relevant installation lifecycle behavior, with the permissions of the invoking user. Because latest can resolve to a different release at any time, the code ultimately executed is not necessarily the version that was reviewed.

This is particularly significant because the document states that specific upstream skill versions were inspected, but the installation commands do not pin those versions. The update --all command further permits all installed skills to be replaced with later, unreviewed versions. No lockfile, package-integrity validation, checksum verification, or post-download review step is specified.

This finding does not establish that the named packages are currently malicious. The vulnerability is the unsafe, mutable trust boundary through which compromised or unexpectedly changed upstream code could be executed after this skill was reviewed.

Attack Path

1. An attacker compromises an upstream npm package, its publisher account, a transitive dependency, or an associated skill release.
2. The attacker publishes a malicious version that becomes the package's ...[truncated 1468 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every @latest reference with an explicitly reviewed package version, for example clawhub@X.Y.Z and shadcn@X.Y.Z.
2. Pin the installed upstream skills to the exact versions documented as inspected rather than silently selecting newer releases.
3. Remove npx -y clawhub@latest update --all. Update each dependency individually only after reviewing its release, provenance, and content.
4. Avoid suppressing confirmation with -y for security-sensitive installation and update operations.
5. Use a committed lockfile and deterministic package installation where the surrounding project supports it.
6. Verify npm package provenance and integrity metadata before execution. For higher-assurance environments, download and inspect the package without running it, then compare an approved checksum or artifact digest.
7. Review downloaded skill files before enabling them, especially scripts, executable hooks, tool instructions, and changes to required permissions.
8. Execute installation tooling in a minimally privileged, isolated environment without production secrets or unrelated credentials.
9. Document a controlled upgrade process requiring review and approval whenever a pinned CLI, skill, or transitive dependency changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

- `SKILL.md` with YAML frontmatter and Markdown body

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to execute npx -y clawhub@latest install ..., which fetches and runs the latest published package at execution time rather than a reviewed, pinned version. In a skill intended for non-programmers, this creates a supply-chain execution path where a compromised or malicious upstream release could run arbitrary code on the user's machine with little scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line repeats the same unsafe pattern: executing clawhub@latest through npx, which implicitly trusts the current registry state at runtime. Because the skill is user-invocable and aimed at simplifying setup, users are likely to copy-paste the command directly, amplifying the risk of supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Invoking npx -y clawhub@latest install react-expert causes remote code execution from an unpinned package version at the moment the command is run. If the package or one of its dependencies is hijacked, the attack surface includes arbitrary local command execution during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

npx -y clawhub@latest update --all is especially risky because it combines unpinned execution with a broad update operation that may change multiple installed artifacts at once. This increases the blast radius of a malicious or compromised release and reduces reproducibility.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Although this line only lists installed items, it still uses npx -y clawhub@latest list, which executes an unpinned remote package before performing the listing action. The impact is somewhat lower than install/update commands, but the core risk remains arbitrary code execution from an unreviewed latest package.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

npx shadcn@latest init downloads and executes the newest CLI release without version pinning, creating the same supply-chain risk as the clawhub commands. Because this command initializes project files and may modify local configuration, exploitation could affect both the developer environment and generated code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command continues the unsafe pattern by running npx shadcn@latest add ..., which trusts the latest CLI and its transitive dependencies at execution time. In the context of a skill for non-programmers producing copy-paste commands, the likelihood of blind execution is high, making the exposure more dangerous.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.