Frontend Design

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:01 PM UTC
• Version: 1.0.2

Overview

This frontend-design skill is mostly coherent and purpose-aligned, but it should be used with awareness that it reads limited workspace context and saves generated design files by default.

Install only if you are comfortable with a frontend design helper that reads limited workspace brand context and writes generated pages into ~/workspace/designs by default. Keep secrets or private agent notes out of SOUL.md and KNOWLEDGE.md, and only use the Discord/outbound delivery path when you intend to share the generated HTML.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:45

Finding

Automatic Access to Persistent Workspace Context Files

Content

View full analysis

5. **Check brand context first.** If SOUL.md, KNOWLEDGE.md, or brand files exist in the workspace, read them before designing. Use existing brand colors, voice, and assets — don't invent a new palette when one already exists. ``` ```markdown ## Required Execution Workflow ### Step 1: Check Brand Context Before designing, check if the workspace has brand information: ```bash cat ~/workspace/SOUL.md 2>/dev/null | head -20 cat ~/workspace/KNOWLEDGE.md 2>/dev/null | head -20 ``` If brand files exist, extract: - Brand colors → use as your palette foundation - Voice/tone → match the visual energy to the verbal energy - Products/offers → inform CTA language - Target audience → drive layout density and aesthetic direction ``` ### Technical Analysis The skill mandates reading the first 20 lines of `~/workspace/SOUL.md` and `~/workspace/KNOWLEDGE.md` before performing frontend-design tasks. These files may hold persistent agent identity, user preferences, business information, behavioral rules, or other context unrelated to the requested design. This violates least-privilege principles because the skill accesses general-purpose persistent context rather than requesting only a dedicated, task-specific brand file. Shell error output is suppressed, so the access may occur without making the attempted reads apparent to the user. The reviewed instructions do not explicitly transmit this information to an external service, modify the files, or read their complete contents. Consequently, the confirmed exposure is limited to bringing up to 20 lines from each file into the active agent context, with possible indirect inclusion in generated frontend content. ### Attack Path 1. A user invokes the frontend-design skill for an ordinary design request. 2. The ski ...[truncated 1489 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs writing files into the workspace by default without an explicit user-facing consent checkpoint. In an agent environment, silent local file modification can surprise users, overwrite work, or create artifacts they did not authorize.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger phrase 'Make it look good' is broad enough to match many ordinary requests, causing the skill to activate in contexts the user may not intend. Over-broad activation increases the chance of unsolicited file creation, style changes, or execution of the skill's write/copy workflow.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The instruction to make strong assumptions and proceed discourages clarification and authorizes autonomous decisions about user intent, content, and outputs. In combination with file-writing behavior, this can lead the agent to produce and save artifacts the user did not actually want.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

- Content hierarchy
- Device priority if obvious

Do not ask the user for missing details unless the request is genuinely impossible without them. If details are missing, make strong assumptions and proceed.

### Step 3: Process Reference Screenshots

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

The skill explicitly persists artifacts to fixed workspace and outbound paths, including copying files into a Discord/media directory. Persistent writes and outbound staging can leak data across sessions or publish content beyond the immediate task if done without clear authorization.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

Save the file:

bash

mkdir -p ~/workspace/designs/[project-slug]
# Write to ~/workspace/designs/[project-slug]/index.html

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md

### Typography Rules

- Create a clear headline scale (hero → h2 → h3 with meaningful size drops)
- Use `clamp()` for fluid sizing: `font-size: clamp(36px, 6vw, 64px)`
- Maintain readable line lengths (max 65-75 characters for body copy)
- Strong contrast between headline, body, and support text

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill embeds unrelated self-promotional and monetization content inside operational instructions. While not directly code-executing, this can bias agent behavior toward marketing outputs unrelated to the user's task and creates instruction contamination in a privileged skill context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.