Frontend Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:19 PM UTC
• Version: 1.0.2

Overview

This frontend guidance skill is mostly coherent, but it includes under-disclosed commands that can execute mutable third-party npm code despite claiming read-only behavior.

Review this skill before installing if your agent may execute setup commands automatically. The design guidance is low risk, but use a pinned and reviewed shadcn version, run package setup only in projects you trust, and expect those commands to modify local files and potentially use the network.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: stack.md:50

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: stack.md, lines 50-52
Vulnerability Type: Supply-chain risk caused by executing a mutable package version
Risk Level: Medium

Vulnerable Code:

bash

npx shadcn@latest init
npx shadcn@latest add button card dialog

Technical Analysis

The documented commands instruct the user or Agent to execute the npm package identified by the mutable latest tag. If the package is not already available locally, npx can retrieve it from the configured npm registry and immediately run its CLI code.

Because no exact version or integrity value is specified, the code executed in the future may differ from the code available when this Skill was audited. A compromised package release, maintainer account, registry response, or transitive dependency could therefore introduce arbitrary behavior.

This also conflicts with the claims in SKILL.md that the Skill is read-only and never makes network requests. Although the Markdown file does not execute the commands automatically, following its setup instructions can cause both network access and local filesystem modifications.

Attack Path

1. An attacker compromises the upstream package publication process, a maintainer account, or a dependency included by a future latest release.
2. The attacker publishes a malicious version that becomes the package's latest version.
3. A user or Agent follows the instructions in stack.md.
4. npx resolves and potentially downloads the mutable package version from the configured registry.
5. The package's CLI code executes with the permissions of the invoking user.
6. The malicious code can access resources available to that user and modify the current project or other user-writable locations.

Impact Assessment

Successful exploitation could execute arbitrary code with the invoking user's privileges. Depending on the execution environment, this may permit modification of proje ...[truncated 414 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable latest tag with an exact, reviewed version:

   bash

   npx shadcn@X.Y.Z init
   npx shadcn@X.Y.Z add button card dialog
   

2. Prefer declaring the CLI as a development dependency with an exact version and committing the resulting lockfile.
3. Invoke the lockfile-resolved local package rather than allowing transparent retrieval of a new release.
4. In controlled or automated environments, install dependencies in a separate reviewed step and use offline execution where practical:

   bash

   npm exec --offline shadcn -- init
   

5. Verify package provenance and registry integrity before installation, and review release changes before updating the pinned version.
6. Clarify in SKILL.md that these optional setup commands may access the network, execute third-party code, and modify local project files.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The phrase "User needs web UI built" and the statement that the agent handles "any frontend requiring production polish" do not define clear activation boundaries or exclusions. This is vague enough to overlap with many general development or design requests, increasing the chance the skill is invoked outside its intended scope.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx shadcn@latest executes the latest package version at runtime rather than a pinned, reviewed version. If the upstream package is compromised or a breaking/malicious release is published, users of this skill could unknowingly run untrusted code on their development machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx shadcn@latest executes the latest package version at runtime rather than a pinned, reviewed version. This creates a supply-chain risk because anyone following the instructions may run newly published code without prior validation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.