ClawHub
Back to skill

Security audit

Design To Html

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent design-to-HTML purpose, but it renders generated HTML in an under-contained browser and can modify the Python environment by installing an unpinned package at runtime.

Review before installing. Use this only in an isolated environment, avoid rendering untrusted HTML with network access, prefer pinned dependencies and a lockfile, and remove or gate the automatic pip install behavior before routine use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/render.js:12
Finding

Untrusted HTML Is Executed in an Unsandboxed Browser with Network Access

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/pipeline.py:17
Finding

Runtime Installation of an Unpinned Python Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

md
node scripts/pipeline.js <original-image> [--threshold 95] [--iterations 5] [--output-dir ./output]

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README is written primarily in Chinese and presents the skill behavior and usage in that language without indicating language negotiation or honoring the user's preferred language. In a multi-user or multilingual agent setting, this can lead to user confusion, misinterpretation of instructions, and incorrect execution, especially when the agent inherits the README style instead of responding in the user's language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger example "帮我把这个设计图转成 HTML 代码" is broad and closely matches a natural, common user request. In agent ecosystems that auto-activate skills based on trigger phrases or README guidance, this can cause the skill to engage unexpectedly on generic prompts, increasing the chance of misrouting, unintended tool use, or prompt-scope capture.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: design-to-html
description: Convert visual design mockups/images to pixel-perfect HTML/CSS code through iterative refinement. Use when user wants to: (1) Convert a design image/screenshot to HTML code, (2) Generate web pages from visual mockups, (3) Create HTML that matches a design pixel-by-pixel, (4) Iteratively improve HTML to match visual design. Triggers on phrases like "convert design to HTML", "from image to code", "pixel-perfect HTML", "design mockup to code".
metadata:
  openclaw:
    requires:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Installing dependencies during execution is risky in this context because the documented purpose is image analysis, not environment modification. This broadens the trust boundary to the package index and installer toolchain, allowing unexpected network access and execution of unreviewed package install paths on the user's machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script performs automatic package installation without warning or consent, which is unsafe for an agent skill because users may not expect network access, subprocess spawning, or environment changes. In agent-executed contexts this is more dangerous, since it may run unattended and alter shared environments or trigger supply-chain exposure silently.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

The script automatically invokes pip in a subprocess at runtime when Pillow is missing. This creates an unexpected code-execution and supply-chain risk because package installation pulls and executes external package installation logic without explicit user approval, and it is not necessary for the core behavior of a local analysis script.

Content

Scanner excerpt · scripts/pipeline.py (reported line 22)May include surrounding context.

python
except ImportError:
    print("Installing Pillow...")
    import subprocess
    subprocess.check_call([sys.executable, "-m", "pip", "install", "Pillow"])
    from PIL import Image
    import io

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The manifest uses a caret range for puppeteer instead of an exact version, which makes builds non-reproducible and can cause different installations to resolve to different dependency versions over time. In a security-sensitive automation package, this increases supply-chain uncertainty and makes it harder to verify whether known-vulnerable or patched releases are actually installed.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"pipeline": "node scripts/pipeline.js"
  },
  "dependencies": {
    "puppeteer": "^21.0.0",
    "pixelmatch": "^5.3.0",
    "pngjs": "^7.0.0",
    "sharp": "^0.32.0"

Unverifiable Dependency: puppeteer has 1 known advisory(ies) (CVE-2019-5786 (Use-After-Free in puppeteer)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
87% confidence
Finding

Puppeteer has known historical advisories, but the manifest's non-exact versioning prevents reliable determination of whether an affected release may be installed. In a package that automates browser rendering, this ambiguity increases risk because the effective dependency version may differ by environment and could expose browser-driven attack surface.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The pixelmatch dependency is specified with a caret range, allowing future compatible releases to be installed implicitly. While not directly an exploit by itself, this weakens dependency integrity and can introduce unreviewed code changes or security regressions into downstream environments.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "puppeteer": "^21.0.0",
    "pixelmatch": "^5.3.0",
    "pngjs": "^7.0.0",
    "sharp": "^0.32.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The pngjs dependency is not pinned to a single version, so installations may vary across environments and time. This creates avoidable supply-chain risk because a newly published package version or compromised dependency release could be pulled in without explicit review.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"dependencies": {
    "puppeteer": "^21.0.0",
    "pixelmatch": "^5.3.0",
    "pngjs": "^7.0.0",
    "sharp": "^0.32.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The sharp dependency is declared with a caret range rather than an exact version, increasing uncertainty around which native package and transitive binary components are installed. Because sharp includes native/image-processing dependencies and has a history of advisories, leaving it unpinned makes security verification and incident response harder.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
"puppeteer": "^21.0.0",
    "pixelmatch": "^5.3.0",
    "pngjs": "^7.0.0",
    "sharp": "^0.32.0"
  },
  "engines": {
    "node": ">=16.0.0"

Unverifiable Dependency: sharp has 4 known advisory(ies) (GHSA-54xq-cgqr-rpm3 (sharp vulnerability in libwebp dependency CVE-2023-4863); GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); CVE-2022-29256 (sharp vulnerable to Command Injection in post-installation over build environmen) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
93% confidence
Finding

Sharp has multiple known advisories and relies on native/image-processing components, but the package manifest does not pin the installed version, so it is not possible to verify whether a vulnerable build will be resolved. Given the image-processing context of this skill, that uncertainty is more concerning because malicious or malformed image inputs may interact with vulnerable parsing libraries.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.