React Local Business Website

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:47 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent React website generator, but it can create misleading business pages and uses broader-than-needed setup and preview commands that deserve review before installation.

Install only in an isolated project environment, review and pin npm dependencies before running setup, and bind the dev server to localhost unless you intentionally need remote access. Before publishing any generated site, replace placeholder business details, verify all reviews/licenses/awards/statistics, and connect the contact form to a real backend or remove success/privacy claims.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned npm packages and mutable CLI dependencies are downloaded and executed

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:137

Finding

Vite development server is bound to all network interfaces by default

Content

View full analysis

&& npx vite --host 0.0.0.0 --port 5173", background: true) # Access: http://localhost:5173 ``` ### Technical Analysis The `--host 0.0.0.0` option binds the Vite development server to every available IPv4 network interface. This is broader than necessary for the documented localhost preview use case and conflicts with the following comment, which only identifies `http://localhost:5173` as the intended access point. A development server should not be treated as a production-hardened service. Its accessibility depends on host firewall, container, virtual-machine, and network configuration. Binding it to all interfaces can make it reachable by other devices on a local network or by infrastructure peers. ### Attack Path 1. The agent starts Vite using the documented command. 2. Vite listens on port 5173 on all interfaces. 3. The host firewall or surrounding network permits another system to reach that port. 4. A network-adjacent party connects to the development server and accesses the served application or exposed development endpoints. ### Impact Assessment The immediate impact is unauthorized access to the development website and any information exposed through the development server. The accessible scope depends on the Vite version, enabled plugins, project contents, network controls, and runtime configuration. The audited instructions do not establish remote code execution or privilege escalation. The confirmed issue is avoidable network exposure beyond the local preview requirement. ]]>

Remediation

View remediation

other

Warning

• Location: assets/landscaping-template/pages/Contact.jsx:24

Finding

Contact form reports successful delivery without transmitting the request

Content

View full analysis

{ const e = {}; if (!form.name.trim()) e.name = "Name is required"; if (!form.email.trim() || !/\S+@\S+\.\S+/.test(form.email)) e.email = "Valid email is required"; if (!form.message.trim()) e.message = "Please tell us about your project"; return e; }; const handleSubmit = (e) => { e.preventDefault(); const errs = validate(); if (Object.keys(errs).length) { setErrors(errs); return; } setSubmitted(true); }; ``` The resulting interface claims successful delivery: ```jsx

Message Sent!

Thanks, {form.name.split(" ")[0]}! We'll review your request and reach out within 1 business day.

``` It also presents an unsupported privacy statement: ```jsx Your information is secure and will never be shared with third parties. ``` ### Technical Analysis After validation, `handleSubmit` only changes the local React `submitted` state. It does not call `fetch`, submit to an HTML action, invoke an email provider, or communicate with a backend. The interface nevertheless states that the message was sent and promises a business response. The form values remain in client-side React state during the page session; no data exfiltration was found. However, the success state misrepresents delivery. The statement that information is secure and will never be shared is also unsupported because no privacy policy, storage design, transport implementation, or server-side data handling exists in the template. The same fake ...[truncated 933 chars]

Remediation

View remediation

other

Warning

• Location: references/page-templates.md:195

Finding

Template prescribes and displays unverified business trust claims

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest says to use the skill when a user asks to 'build or design a website for a local/small business using React,' which is broad natural language that could overlap with many ordinary website-design requests. It does not provide explicit boundaries, trigger phrases, or exclusion cases to clarify when this skill should or should not activate.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The skill instructs use of npx tailwindcss without pinning an exact version for the invoked package binary. Because npx may resolve and execute whatever version is available or fetched at runtime, this can lead to non-reproducible builds and supply-chain exposure if a compromised or incompatible package version is installed or executed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The dev-server instruction uses npx vite without pinning the exact package version. This means the executed tool may vary by environment or fetch a newer package at runtime, increasing supply-chain risk and making behavior less predictable if a malicious or breaking release is resolved.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.