Security audit

Design To Code Local

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward design-to-code guidance skill with no executable payload, hidden access, persistence, or credential handling.

Install this if you want a Chinese-first workflow for recreating design mockups as frontend code. Be aware that it may activate for broad UI implementation requests; users should provide clear design artifacts or instructions when using it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The README is written entirely in Chinese and does not indicate that the skill can adapt to the user's language, which may cause the skill to respond in Chinese even when the user is operating in another language. This is primarily a safety and usability issue because language mismatch can lead to misunderstood instructions, incorrect implementation details, or users missing important warnings and assumptions.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The activation criteria are broad enough to trigger on generic phrases like '按设计稿实现' or whenever a user shares a design link or screenshot, which can cause the skill to activate outside clearly intended contexts. Over-broad auto-activation increases the chance of inappropriate routing, unintended handling of shared assets, and user confusion about why specialized behavior was invoked.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill description uses broad phrases like implementing designs and converting mockups to code, which can overlap with many normal frontend requests and cause the agent to invoke this skill when the user did not explicitly ask for design-to-code behavior. Over-broad routing increases the chance of incorrect tool selection, scope drift, or unintended processing of user-provided links and assets.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger conditions combine explicit requests, optional links/screenshots, and general UI implementation needs without stating which inputs are mandatory. This ambiguity can cause the skill to activate on incomplete context, leading the agent to infer missing requirements or act on weak signals, which is unsafe from a routing and authorization perspective.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The skill name, tagline, and description are written entirely in Chinese, which suggests a fixed language experience without offering an explicit language/locale choice. Under the policy rules, locale or language constraints should be opt-in or clearly justified to avoid excluding users who do not use that language.

Natural-Language Policy Violations

Low

Confidence: 72% confidence
Finding: The file presents the skill name, title, and trigger phrases primarily in Chinese while also embedding English text, but it does not state that language choice depends on user preference. This may create an implicit language/locale constraint instead of offering the user a clear language option.

Static analysis

No suspicious patterns detected.