Security audit

Visual Dna

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent design-analysis and UI-generation skill, with user-facing caveats around remote references and an unpinned Three.js CDN suggestion.

Install only if you are comfortable using it on references you are allowed to analyze. Treat URL analysis and original-asset reuse as network activity that may expose metadata to third-party sites, avoid private or credentialed references unless explicitly intended, and pin or vendor Three.js before using generated 3D pages in production.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/generation-guide.md:96
Finding: Unpinned Third-Party JavaScript Dependency Allows Mutable Remote Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `references/generation-guide.md`, lines 96-101 **Vulnerability Type**: Unpinned executable CDN dependency **Risk Level**: Medium ### Vulnerable Code ```markdown ### 3D elements - Default to Three.js - Apply lighting, camera, materials from params - Handle resize with ResizeObserver - CDN: `https://cdn.jsdelivr.net/npm/three@latest/build/three.module.js` ``` ### Technical Analysis The generation guide directs the agent to use the mutable `@latest` version of Three.js from a third-party CDN. Because no exact package version or integrity hash is specified, the effective JavaScript payload can change after the Skill has been reviewed. If generated HTML imports this URL, every future page load may retrieve and execute whichever package version the CDN currently resolves as `latest`. A compromised package release, package registry account, CDN, or upstream distribution process could consequently introduce attacker-controlled JavaScript. This recommendation also conflicts with the Skill's stated preference for self-contained output. The remote dependency makes generated interfaces dependent on network availability and an external supply chain. ### Attack Path 1. The user requests UI generation involving 3D effects. 2. The agent follows the generation guide and imports Three.js from `https://cdn.jsdelivr.net/npm/three@latest/build/three.module.js`. 3. An attacker compromises the upstream package publication process, package maintainer account, or CDN distribution path. 4. The mutable `@latest` reference resolves to attacker-controlled JavaScript. 5. A user opens the generated page while connected to the network. 6. The browser downloads and executes the malicious module in the generated page's JavaScript context. ### Impact Assessment Successful exploitation permits arbitrary JavaScript execution in the context of the generated page. Depending on where the generated UI is deployed, malicious code could: ...[truncated 603 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, exact version, for example: ```text https://cdn.jsdelivr.net/npm/three@<exact-version>/build/three.module.js ``` 2. Prefer vendoring the reviewed dependency into the generated project so output remains self-contained and reproducible. 3. Record and review dependency updates explicitly rather than allowing automatic resolution to new releases. 4. Where the loading mechanism supports it, require Subresource Integrity and an appropriate `crossorigin` policy. 5. Apply a restrictive Content Security Policy that limits permitted script and network destinations. 6. Use a dependency lockfile and automated vulnerability scanning when generating a packaged application. 7. Prefer native CSS, SVG, or Canvas implementations when the requested effect does not require a large external library. 8. Update the generation quality checklist to reject mutable dependency specifiers such as `latest`, wildcard versions, and unreviewed remote scripts. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly states that the skill will analyze user-supplied URLs or existing project assets and also says it does not judge ownership, sensitivity, or permission. That creates a real security and privacy risk because users may be encouraged to process third-party, internal, or otherwise sensitive visual assets without any guardrails, warnings, or consent checks. In this skill context, the issue is more dangerous because the core workflow is reference analysis, so misuse is a normal-path behavior rather than an edge case.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill tells the agent to analyze or fetch user-supplied URLs and explicitly says not to judge ownership, sensitivity, or permission, but provides no privacy or data-transfer warning. This can lead users to unknowingly cause external requests or submit internal, sensitive, or credential-gated references for analysis without informed consent or safeguards.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill explicitly instructs the agent to fetch and reuse real assets from original URLs, expanding behavior from local analysis/generation into external resource acquisition. That can cause unannounced network access, ingestion of third-party content, and reuse of copyrighted or sensitive assets without validation, which is risky even if framed as improving fidelity.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: Encouraging the agent to fetch assets from original URLs without warning the user about external access creates a privacy and supply-chain risk. It may contact third-party servers, leak usage metadata, and pull in untrusted or changing resources, all outside the user's expectations for a design-extraction skill.

Static analysis

No suspicious patterns detected.