design-taste

• Outcome: Pass
• Latest audit: Oct 18, 2026 · 6:55 AM UTC
• Version: 1.1.0

Overview

This is a coherent design-review/build skill whose scripts and guidance match its visual design purpose, with a caution around live website review behavior.

Install only if you want design-focused review/build guidance and local visual-metric scripts. For live website reviews, use URLs you are comfortable loading from your environment, and be aware the helper may click common cookie/consent buttons while capturing screenshots.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (21)

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/image-aesthetics.md (reported line 66)May include surrounding context.

md

| `tone.clip_light_pct / clip_dark_pct` | < 3% / < 5% for photos | UI and posters often legitimately have flat white/black |
| `tone.contrast_rms` | 40–85 | < 30 flat/foggy, > 90 harsh |
| `tone.saturation_p95` | < 0.85 | > 0.92 = neon/over-graded risk |
| `colorfulness` (Hasler–Süsstrunk) | 15–33 "moderately", 33–59 "quite", > 82 "extremely" colorful | describe, don't judge, by itself |
| `palette_significant_colors` (≥ 3%) | ≤ 5 poster/product, ≤ 8 photo | merged k-means clusters; neutrals count |
| `harmony_guess` | — | guess from hue clusters; confirm visually |
| `composition.centroid_to_thirds_point` | < 0.12 for thirds-style images | edge-energy centroid ≈ visual weight; small distance to center can be intentional |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · scripts/review_image.py (reported line 22)May include surrounding context.

python

Pure Pillow + numpy (uses OpenCV only if already installed). No network access.
Metrics are proxies: they catch blur, clipping, muddy palettes, crowded or off-balance
layouts. They do NOT judge meaning, emotion, or AI artifacts — the agent must look at the image.
"""
import argparse, colorsys, json, math, os, sys

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to run network-capable review tooling such as scripts/review_site.py against live URLs, but it declares no explicit tool scope or permission boundary. That creates an authorization gap: the skill can induce browsing/network actions without clear least-privilege constraints, making unintended external access, data exfiltration, or SSRF-style misuse more plausible if a user supplies attacker-controlled targets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Chinese trigger list includes short, generic phrases such as 设计界面, 美化页面, and 配色 that overlap with everyday requests and can cause accidental activation. In multilingual environments this makes unintended invocation even more likely, especially because the skill also directs external tooling and multi-step build behavior once activated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The Chinese trigger list includes short, generic phrases such as 设计界面, 美化页面, and 配色 that overlap with everyday requests and can cause accidental activation. In multilingual environments this makes unintended invocation even more likely, especially because the skill also directs external tooling and multi-step build behavior once activated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This JSON file includes natural-language prompts that explicitly require responses in Chinese (for example, '帮我…'). Under the policy, forcing a specific language without user opt-in or justification is a locale-policy concern, and no opt-in or region-specific rationale is documented here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The prompt text is written to elicit a Chinese-language interaction, but the file does not state that language is user-selectable or that the skill is region-specific. That can violate the language/locale policy when a specific language is imposed implicitly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This prompt also uses Chinese as the required interaction language, with no accompanying note that the user opted into that locale or that the skill is limited to a Chinese-speaking context. The file therefore contains a natural-language locale constraint lacking explicit justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Line L81 discusses 'China vs US' and prescribes fixes specifically for Chinese sites, including 'CJK body text at 16px' and a mandated font stack. This is a natural-language locale policy constraint applied to a language/locale group without any indication of user opt-in or a clearly scoped regional compliance purpose.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file defines invocation cues such as "Review," "polish," "what's wrong with this UI," and "make it premium" as mode selectors. These phrases are broad everyday requests and the table does not provide exclusion conditions or negative examples, so it is unclear when these modes should or should not activate.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/redesign.md (reported line 19)May include surrounding context.

md

## Rules
- Small, reviewable steps; keep diffs per layer.
- Don't swap frameworks or add heavy dependencies for looks.
- Don't delete functionality or content to make it "cleaner" without asking.
- Variants: "bolder" = more contrast/scale/color commitment; "quieter" = fewer colors, less decoration, more space; "distill" = remove elements until each remaining one earns its place.
- Report: what changed, before/after metrics, anything deferred.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/site-review.md (reported line 97)May include surrounding context.

md

## Rules
- Small, reviewable steps; keep diffs per layer.
- Don't swap frameworks or add heavy dependencies for looks.
- Don't delete functionality or content to make it "cleaner" without asking.
- Variants: "bolder" = more contrast/scale/color commitment; "quieter" = fewer colors, less decoration, more space; "distill" = remove elements until each remaining one earns its place.
- Report: what changed, before/after metrics, anything deferred.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The docstring states 'The script never downloads anything itself,' yet the core behavior is page.goto(url) followed by page rendering, lazy-load scrolling, and screenshots, which necessarily fetch the target page and associated resources over the network. This is an active contradiction in the file's own documentation, not merely an omitted implementation detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script automatically clicks consent/accept buttons on behalf of the user, which can submit legal/privacy choices the user did not explicitly approve. In this skill context, the tool is meant to review arbitrary live websites, so silently accepting tracking or terms on many third-party sites increases privacy and compliance risk and may alter the reviewed page state in ways the operator did not intend.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file includes prescriptive guidance such as specific Chinese palette terminology, Chinese font recommendations, and ink-style concepts for wuxia and ink sections. Because this is natural-language instruction in a generally applicable rubric file rather than a clearly scoped region-specific compliance document, it can be read as imposing a specific language/locale convention without explicit user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The template explicitly instructs use of 'Chinese ink wash (水墨)' for the generated game scene, which imposes a specific language/locale-cultural framing in the prompt text. The file does not indicate that this locale-specific style is optional or user-selected at this point in the template.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 63% confidence

Finding

The mode table embeds Chinese trigger examples alongside English ones, but does not explain whether multilingual triggering is optional, exhaustive, or user-selectable. Because policy checks apply to natural-language handling across all file types, undocumented locale behavior can be interpreted as an implicit language policy choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This CSV contains user-facing natural-language comment fields in both Chinese (comment) and English (comment_en) across the dataset, but the file provides no indication of intended audience, language-selection behavior, or opt-in for locale. Because SQP-3 applies to all file types, this is a policy concern where language presentation appears fixed rather than explicitly user-selectable or justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script hard-codes locale="en-US" for browsing sessions, which can alter site content, consent flows, and formatting based on locale. This is a natural-language locale policy concern because the tool selects a language/region preference without first offering the user a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The mobile capture path repeats the same hard-coded locale behavior, making both desktop and mobile reviews default to a specific language/region. This can conflict with language/locale choice expectations unless explicitly documented and user-selectable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.