ClawHub
Back to skill

Security audit

react-component-generator-design-systems

Security checks across malware telemetry and agentic risk

Overview

This skill gives instructions for generating React UI components that match a project’s design system, with no hidden execution, persistence, or credential handling found.

Before installing, understand that the skill may activate for many React component requests and may inspect nearby project files to match existing UI patterns. That behavior is disclosed and purpose-aligned; review generated code normally before committing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The activation conditions are very broad and match many ordinary frontend requests, which can cause the skill to trigger outside narrowly intended scenarios. While this is not directly exploitative code behavior, over-broad invocation increases the chance of unintended project scanning, irrelevant code generation, or the skill steering responses when a more appropriate skill or direct reasoning path should have been used.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.