Security audit

CSS

Security checks for vulnerabilities and agentic risk

Overview

This is a CSS help skill with local preference memory; it is disclosed and purpose-aligned, with no executable payload or evidence of deceptive behavior.

Before installing, be aware that this skill may read and maintain local CSS preferences and project-context notes in ~/Clawic/data/css/. That behavior is disclosed and scoped to better CSS help; review or clear those files if you do not want project conventions or preferences reused across sessions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
- Inside a context, z-index competes only among siblings of that context. A child's `z-index: 9999` never escapes its parent's `z-index: 1`. - Debug procedure, in order: (1) walk up from the losing element to its first context-creating ancestor; (2) same for the winning element; (3) compare those two ancestors — that comparison decides the paint order; (4) fix z-index there, or delete the accidental trigger (usually a leftover `transform` or `opacity` from an animation). - `isolation: isolate` creates a context with zero visual side effects — use it to cap a component's internal z-index so it can't leak out. - `transform`, `filter`, and `will-change` also make the element the containing block for `position: fixed` descendants — the fixed element behaves as absolute with no warning. Same walk-up diagnosis. - Elements promoted to the top layer (modal `<dialog>`, `popover`) ignore all of the above: they paint above the page and above each other in open order (rule 7). ## Flexbox and Grid Mental Model

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · debugging.md (reported line 62)May include surrounding context.
md
## Works in Chrome, Not in Safari or Firefox 1. Is the property supported at all? Check the feature, not the browser: an unsupported declaration is dropped without warning, and the Styles panel shows it struck or greyed. 2. Is it a whole-rule kill? One unrecognized selector in a comma-separated list invalidates the ENTIRE list in every engine — `::-webkit-slider-thumb, ::-moz-range-thumb {}` styles nothing anywhere. Split into one rule per engine. 3. Prefix or different spelling needed? `backdrop-filter` and the `mask` shorthand still want `-webkit-` in older Safari, and form controls need `appearance: none` AND `-webkit-appearance: none` there. 4. Same CSS, different result → engine-level behavior difference (flex percentage heights, sticky in tables, form control internals), not a bug in your file.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · memory-template.md (reported line 13)May include surrounding context.
md
last: YYYY-MM-DD ## Context

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to read and persist user preferences and prior context in local files, including work habits, platform details, constraints, and recurring issues, without any explicit user notice or consent flow. This creates a privacy and data-governance risk because the agent may silently accumulate cross-session behavioral or project-context data that users do not expect to be stored or reused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The markdown recommends color-scheme: light dark as a default base-layer behavior. While this is generally benign, it is natural-language guidance that imposes a presentation policy without explicitly mentioning user choice or opt-in, which fits the requested policy-check category for documented constraints.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: This line again prescribes a default theme-related behavior in natural language. Because the policy check applies to all file types and covers forced language/locale-style constraints, this merits a low-severity note unless the document explicitly states that user or system preference is being respected.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.