T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:24- Finding
Mandatory Retrieval and Execution of Mutable Remote Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Superdesign
Security checks for vulnerabilities and agentic risk
Overview
This design skill is purpose-aligned, but it gives mutable remote instructions, an unpinned global installer, and broad repository source upload too much automatic control.
Install only if you are comfortable with this skill reading substantial frontend source, writing .superdesign files, installing or updating a global npm CLI, logging into SuperDesign, and sending selected repository files to that service. Prefer using it in a non-sensitive repo or sandbox, review files before upload, and require explicit approval for installs and remote context transmission.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
INIT.md:15- Finding
Excessive Collection and External Transmission of Repository Source Code
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:55- Finding
Automatic Installation of an Unpinned Global npm Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (18)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs the agent to write multiple files directly into the user's repository, but provides no caution about modifying project files, obtaining confirmation, or using a safer temp/output location. In an agent setting, unattended repository writes can create unwanted changes, pollute working trees, and be chained with later steps that commit or exfiltrate generated artifacts.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions explicitly require copying full source code for components into generated context files, which can duplicate proprietary code and any embedded secrets or sensitive logic into a new artifact set. That broad code replication materially increases exposure risk, especially if downstream tools upload, index, or share the generated
.superdesign/init/contents.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Requiring full layout files, router configs, and related source to be copied verbatim expands the scope beyond UI appearance into application structure and implementation details. Layouts and routing often include auth flows, feature flags, internal URLs, role checks, and other sensitive logic that should not be broadly recopied into agent-generated context bundles.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Theme extraction asks for complete raw config and CSS files, which may seem low risk but can expose embedded tokens, internal asset paths, environment-dependent configuration, or comments containing operational details. Copying entire config files is unnecessary for most design reproduction and increases the chance of leaking non-design-sensitive repository data.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The stated principle to include 'actual code' generously and prefer more context than less institutionalizes maximal repository copying as normal behavior. In a design-assistant skill, that substantially increases data-leak risk because the agent is encouraged to over-collect code, including material unrelated to the immediate UI task.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad enough that normal requests like 'Help me design X' could activate the skill unexpectedly. In this skill, unintended activation is riskier because activation can lead to autonomous network fetches, filesystem writes, CLI installation, and login flows.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to fetch a remote prompt and then follow its instructions before performing its stated design task. This creates a supply-chain and prompt-injection risk because behavior can be changed by external content outside the reviewed skill file, enabling arbitrary repo analysis, data access, or side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description does not prominently warn users that initialization will automatically fetch remote content and write files into the repository. This undermines informed consent and can surprise users with side effects that may alter their workspace or expose code context externally.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill requires network retrieval of operational instructions as part of initialization, which is not necessary for a static design helper and gives an external party control over the agent's next actions. Because the fetched content is instruction-bearing, this is more dangerous than downloading passive assets or reference data.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The instruction to 'just do it' explicitly pushes autonomous action without user confirmation. In this context, the autonomy is dangerous because it applies to network access, repository analysis, and file creation, reducing the user's ability to review or constrain potentially unsafe operations.
- Content
https://raw.githubusercontent.com/superdesigndev/superdesign-skill/main/skills/superdesign/INIT.md
text Do NOT ask the user to do this manually — just do it. # Mandatory Init Files
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The workflow requires installing a global CLI and authenticating to an external service before any task. That expands the skill from local design assistance into software installation, credential handling, and remote service interaction, increasing the attack surface and enabling persistence or data exfiltration through the CLI.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill omits an adequate warning that it may install software and prompt for authentication to an external service. Users may invoke it expecting local design guidance, not system modification and credentialed external access, which increases security and privacy risk.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill mandates a global npm installation unrelated to a minimally scoped design-assistance role. Global package installation can execute package lifecycle scripts, modify the host environment, and introduce persistence or compromise if the package or dependency chain is malicious.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Requiring fresh remote guideline retrieval on every use means the effective behavior of the skill is controlled by mutable external content rather than the audited manifest. An attacker who compromises the remote source, transport, or repository can silently alter actions the agent takes in the user's environment.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest does not clearly warn that each use requires retrieving fresh remote operational guidance. This hides a material security property: the skill's behavior is dynamically mutable and externally controlled, making auditing and user expectations unreliable.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly authorizes running
npm install -g @superdesign/cli@latestwhen a flag is unavailable. A global package install changes the host environment and executes package lifecycle scripts, which exceeds the expected scope of a UI/UX design skill and can introduce supply-chain or environment-integrity risk. The skill context makes this more dangerous because it frames the action as an automatic recovery step rather than requiring user approval.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs automatic global CLI updates without warning or confirmation. Silent environment modification can surprise users, break reproducibility, and expose them to malicious or compromised package releases, especially because global installs often run with elevated trust and affect future sessions. The design-skill context provides no strong justification for this level of autonomy.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The skill mandates recursive import tracing, scanning the repo for brand assets, and reading broad sets of implementation files to gather context. While this may improve design fidelity, it violates least-privilege by encouraging access to substantially more code and assets than may be necessary for a specific design request, increasing exposure of sensitive source, internal routes, and embedded secrets in adjacent files. In a design skill, this broad collection behavior is less justified and therefore riskier.
- Content
Static analysis
No suspicious patterns detected.