HTML Designer

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:38 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent HTML design reference package with static templates and no evidence of hidden control, credential access, persistence, or unsafe execution.

This looks appropriate to install as a design helper. Treat the bundled HTML files as templates: replace placeholder links, images, social URLs, mailto addresses, and script/style references before using them in a real site.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (19)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/color-palette-showcase.html (reported line 17)May include surrounding context.

html

<body>
  <a href="#main" class="skip-link">Skip to main content</a>
  
  <!-- Header with subtle color accent -->
  <header class="header-chromatic">
    <div class="container">
      <nav class="navbar-color" aria-label="Main navigation">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/design-studio-grid.html (reported line 17)May include surrounding context.

html

<body>
  <a href="#main" class="skip-link">Skip to main content</a>
  
  <!-- Header demonstrates alignment on grid -->
  <header class="header-grid">
    <div class="container-grid">
      <div class="grid-12-col">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/design-studio-grid.html (reported line 157)May include surrounding context.

html

</div>
    </section>
    
    <!-- Projects section - Mixed grid layout -->
    <section id="projects" class="projects-grid-showcase">
      <div class="container-grid">
        <div class="grid-12-col">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/design-studio-grid.html (reported line 224)May include surrounding context.

html

</article>
          </div>
          
          <!-- Projects 4, 5, 6 - Three column layout -->
          <div class="projects-grid-3-col">
            <article class="project-grid-third">
              <a href="/projects/axis-app" class="project-link-grid">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/designer-portfolio-showcase.html (reported line 33)May include surrounding context.

html

</header>
  
  <main id="main">
    <!-- Hero section demonstrates visual hierarchy and balance -->
    <section class="hero-visual">
      <div class="container">
        <div class="hero-content-visual">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/designer-portfolio-showcase.html (reported line 143)May include surrounding context.

html

</div>
    </section>
    
    <!-- Services section demonstrates proximity and grouping -->
    <section id="services" class="services-visual">
      <div class="container">
        <header class="section-header-centered">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/minimalist-services.html (reported line 17)May include surrounding context.

html

<body>
  <a href="#main" class="skip-link">Skip to main content</a>
  
  <!-- Minimal header with generous spacing -->
  <header class="header-minimal">
    <div class="container-wide">
      <nav class="navbar-minimal" aria-label="Main navigation">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/typography-showcase.html (reported line 17)May include surrounding context.

html

<body>
  <a href="#main" class="skip-link">Skip to main content</a>
  
  <!-- Minimal header focusing on typography -->
  <header class="header-type-minimal">
    <div class="container-reading">
      <nav class="navbar-type" aria-label="Main navigation">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ui-ux.md (reported line 13)May include surrounding context.

Screen Reader Support:

html

<!-- Proper heading hierarchy -->
<h1>Main Title</h1>
<h2>Section Title</h2>
<h3>Subsection Title</h3>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ui-ux.md (reported line 120)May include surrounding context.

md

<fieldset>
    <legend>Personal Information</legend>
    
    <!-- Always associate labels with inputs -->
    <div class="form-group">
      <label for="firstName">First Name</label>
      <input

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ui-ux.md (reported line 348)May include surrounding context.

Start Free Trial

Learn More

```

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ui-ux.md (reported line 496)May include surrounding context.

md

srclang="es" 
    label="Español">
  
  <!-- Fallback text -->
  <p>Your browser doesn't support HTML5 video. 
     <a href="video.mp4">Download the video</a>.</p>
</video>

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/ui-ux.md (reported line 821)May include surrounding context.

md

10. **Removing focus outline** without alternative
11. **Infinite scroll without pagination** (accessibility issue)
12. **Modal without keyboard trap** (can't escape with ESC or Tab)
13. **Links that open in new tab** without warning
14. **Justifying text** (creates irregular spacing, hard to read)
15. **Using placeholders as labels** (disappear when typing)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The HTML root declares lang="en", which hard-codes the page language to English. Under the policy rule for natural-language violations, a forced language/locale without opt-in or documented regional justification should be flagged.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The HTML root sets lang="en", which indicates the skill/page is explicitly configured for English. Under the policy criteria, forcing a specific language without user opt-in or documented justification can be a natural-language locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document declares lang="en", which hard-codes English as the page language. Under the stated policy, locale-specific behavior should either be optional for the user or clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document declares lang="en", which hard-codes English as the page language. Under the stated policy, language constraints should either offer user choice or be clearly justified as region-specific; this file provides neither.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The guide repeatedly uses <html lang="en"> in example documents, which can be read as a default recommendation to force English. Because the markdown does not mention adapting lang to the page's actual language or letting locale vary by context, it presents a mild natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The checklist item Language declared is illustrated only as <html lang="en">, which may imply English is required rather than that the document language should be declared appropriately. This is a natural-language locale constraint that lacks opt-in or clarification.

Content

No source excerpt is available for this finding.