Security audit

lanhu-design

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Lanhu design-handoff purpose, but one downloader can read arbitrary local file URLs from slice JSON and copy them into the project output directory.

Review before installing. Use this only with trusted Lanhu projects and trusted slice JSON. Avoid feeding hand-edited or third-party JSON into download_slices.mjs unless file:// handling is removed or explicitly disabled, and treat LANHU_COOKIE as a full login session credential with access to whatever the logged-in Lanhu account can see.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The downloader explicitly accepts file:// URLs from untrusted slice JSON and reads them from the local filesystem via readFile(fileURLToPath(url)). If an attacker can influence the JSON input, they can cause the tool to copy arbitrary local files into the output directory, exposing secrets such as SSH keys, tokens, or config files. In the context of a design-handoff skill that processes external Lanhu-derived data, treating input URLs as trusted makes this more dangerous because users may run it on attacker-supplied or tampered JSON.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill explicitly states it will download design images, specs, and slices and place them into the current project resources directory, but the description does not prominently warn users that invoking the workflow causes local writes into the active repository. In an agent setting, this can lead to unexpected modification of source trees, accidental inclusion of proprietary design assets, or contamination of commits/build outputs if the user did not intend file-system side effects.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the user to extract a live browser session cookie and use it as an environment variable to authenticate requests, which effectively grants the scripts the same access as the logged-in Lanhu account. Although it says the cookie is sensitive and should not be committed, it does not clearly warn that this is account impersonation with full session scope, creating risk of unauthorized data access, leakage to logs/process environments, or misuse if the scripts or environment are compromised.

Static analysis

No suspicious patterns detected.