Security audit

Best Practices

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only web best-practices skill, but it includes copyable advice that could lead generated sites to load mutable third-party JavaScript and send broad error telemetry.

Review the examples before allowing an agent to apply them. Avoid the polyfill.io script recommendation; use locally bundled or pinned polyfills with integrity controls. Add telemetry only with redaction and an approved provider, and review any pre-commit or .claude hooks before copying them into a project.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:536
Finding: Unpinned Third-Party Polyfill Permits Mutable Remote Code Execution
Content: View full analysis
``` ### Technical Analysis The Skill recommends loading executable JavaScript from a third-party service without an immutable version, Subresource Integrity hash, or locally controlled fallback. The returned resource can change after the generated application has been reviewed or deployed. A cross-origin script included through a `script` element executes within the embedding document's JavaScript context rather than within an isolated third-party origin. Consequently, a compromised or malicious remote response could interact with the page DOM, read JavaScript-accessible application data, monitor user input, and issue requests using the user's active browser session. Although this is documentation rather than code automatically executed when the Skill loads, an agent following the recommendation could introduce the unsafe dependency into generated applications. ### Attack Path 1. An agent follows the Skill's recommendation and includes the unpinned Polyfill.io URL in an application. 2. A browser visits the generated application and requests the script from the third-party service. 3. The service, its DNS/CDN infrastructure, or the delivered resource is compromised or unexpectedly modified. 4. The third-party response supplies attacker-controlled JavaScript. 5. The browser executes that JavaScript in the embedding page's context. 6. The payload accesses page data or performs authenticated browser actions within the limits of the page origin, browser security model, and deployed CSP. ### Impact Assessment Successfu ...[truncated 425 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:603
Finding: Global Error Telemetry May Transmit Sensitive Application Data Without Redaction
Content: View full analysis
{ errorTracker.captureException(event.error); }); // Catch unhandled promise rejections window.addEventListener('unhandledrejection', (event) => { errorTracker.captureException(event.reason); }); ``` ### Technical Analysis The Skill recommends sending caught exceptions, React diagnostic information, unhandled errors, and rejected promise values to an unspecified error-tracking service. It does not require allowlist-based serialization, sensitive-data redaction, destination validation, user consent, retention controls, or environment-specific telemetry policies. Exception objects and associated diagnostic context may contain request URLs, query parameters, identifiers, application state, user-provided content, or credentials accidentally embedded in error messages. React error information and tracker SDK enrichment can add further contextual data. Blanket global handlers increase the collection scope because they capture errors from the entire application rather than narrowly defined operations. The behavior is not inherently malicious and can support legitimate production diagnostics. Nevertheless, unrestricted transmission exceeds the minimum data access needed for error reporting and can create an unintended disclosure channel. ### Attack Path 1. A generated application adopts the recommended global or component-level handlers. 2. Sensitive informat ...[truncated 1031 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.
Enforce HTTPS:

html
 <img src="http://example.com/image.jpg"> <script src="http://cdn.example.com/script.js"></script>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.
```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 748)May include surrounding context.
html
 <div id="header"> <div id="header">  <ul> <div>Item</div>

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The documentation includes a specific locale setting, <html lang="en">, as the sole recommended example. Because this skill is a general best-practices guide rather than a region-specific tool, presenting English as the default language without opt-in or explanation can conflict with language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.