Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent website-building guide, but it asks users to create and store powerful long-lived deployment and CMS credentials and runs mutable setup tools, so it should be reviewed carefully before installation.
Install only if you are comfortable with a hands-on website workflow that may create accounts, local projects, Git commits, deployments, CMS content, and local secret files. Prefer short-lived, least-privilege tokens; do not create automation tokens unless you need them; review every npm/npx and deployment command before running it; and revoke any token that is pasted into chat, committed, or no longer needed.
### Technical Analysis
The workflow instructs users to resolve and execute packages dynamically from the npm registry. In particular, the `@latest` tag is mutable and can resolve to code published after the Skill was reviewed. Unversioned `npm install` commands similarly select dependency versions according to the registry state at installation time.
`npx` may download a package and immediately run its executable. Package installation can also invoke lifecycle scripts. Consequently, compromise of a package release, maintainer account, transitive dependency, or package registry can turn these setup instr
...[truncated 1675 chars]
Remediation
View remediation
Remediation Suggestions
Replace mutable package tags with explicitly reviewed versions, for example:
bash
Pin exact dependency versions in package.json rather than relying on registry-time resolution.
Generate, review, and commit package-lock.json.
Use npm ci for repeatable installations after project initialization.
Run npm audit and review package provenance before installation.
Consider disabling lifecycle scripts during initial dependency inspection:
bash
npm install --ignore-scripts
Enable scripts only after confirming that required packages use legitimate installation hooks.
Document that users should execute package setup before placing long-lived production credentials in the project.
Periodically update pinned versions through an explicit review process rather than automatically tracking latest.
T05 · Unauthorized Access and Privilege Escalation
Warning
Location
references/phase2-accounts.md:57
Finding
Deployment and CMS Credentials Are Created with Excessive Lifetime or Scope
Content
View full analysis
Vulnerability Details
File Location: references/phase2-accounts.md:57-63, 82-88, 122-138 Vulnerability Type: Overprivileged and long-lived service credentials Risk Level: Medium
Vulnerable Code
references/phase2-accounts.md:57-63:
markdown
**Getting Vercel API credentials (for advanced management):**
Only needed if using Claude Code to automate deployments:
1. Go to `https://vercel.com/account/tokens`
2. Click **"Create"**
3. Name it: `claude-website-manager`
4. Set expiry: **No expiration**
5. Copy the token — paste it in the `.env.local` file Claude will create for you
references/phase2-accounts.md:82-88:
markdown
**Getting Sanity API credentials:**
After creating the project:
1. Go to `https://sanity.io/manage`
2. Click on your project
3. Go to **API** → **Tokens**
4. Click **"Add API token"**
5. Name: `claude-website-manager`
6. Permission: **"Editor"** (can read and write)
7. Copy the token — paste it in `.env.local`
references/phase2-accounts.md:122-138:
markdown
After all accounts are set up, Claude will create a `.env.local` file in the project.
This file stores all your private keys — it NEVER goes to GitHub (it's in `.gitignore`).
**Template to fill in together:**
```env
# Sanity
NEXT_PUBLIC_SANITY_PROJECT_ID=your_project_id_here
NEXT_PUBLIC_SANITY_DATASET=production
SANITY_API_TOKEN=your_sanity_token_here
# GitHub (only needed for automation)
GITHUB_TOKEN=your_github_token_here
# Vercel (only needed for automation)
VERCEL_TOKEN=your_vercel_token_here
VERCEL_TEAM_ID=your_team_id_here
VERCEL_PROJECT_ID=your_project_id_here
text
### Technical Analysis
The instructions explicitly recommend a Vercel token with no expiration. This creates a credential that remains usable indefinitely unless manually revoked. The Sanity instructions request Editor permission, which provides content read/write capability even
...[truncated 2287 chars]
Remediation
View remediation
Remediation Suggestions
Replace the “No expiration” recommendation with the shortest practical expiration period.
Require periodic rotation and document a concrete revocation procedure.
Create credentials only when automation is actually requested; do not include optional GitHub and Vercel tokens in the default setup.
Prefer GitHub-to-Vercel integration or interactive CLI authentication when those approaches avoid storing a reusable token in the project.
Restrict Vercel credentials to the specific project or team and required operations wherever the service supports such scoping.
Use a read-only Sanity token for read operations. Create an Editor token only when automated content writes are explicitly required.
Keep separate tokens for development and production and avoid reusing credentials across projects.
Store production secrets in the deployment platform's secret manager rather than retaining all service credentials in a project-local file.
Ensure .env.local has restrictive filesystem permissions and remains excluded from source control, archives, diagnostics, and shared backups.
Add guidance to inspect the repository history after accidental secret commits; removing the current file alone does not erase earlier Git objects. Token revocation must remain mandatory.
Audit service access logs after suspected exposure and immediately revoke all affected tokens.
The README states the skill 'triggers automatically' for very broad phrases such as wanting a website, needing help building, site management, or a broken site. That scope overlaps with many normal conversations and can cause the agent to invoke a workflow that leads users toward account setup, repository actions, deployment, and CMS changes without clearly establishing intent boundaries first. In the context of an installable agent skill, overbroad triggering is dangerous because it can redirect unrelated sessions into operational guidance affecting live systems.
Content
No source excerpt is available for this finding.
Vague Triggers
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The manifest description contains very broad auto-trigger phrases such as 'help me build', 'personal site', 'fixing bugs', and even situations where the user is merely 'unsure/nervous'. This can cause the skill to activate in many unrelated conversations, increasing the chance it steers users into account creation, deployment, or code-generation workflows they did not explicitly request, which is a prompt-scope and overreach risk.
Content
No source excerpt is available for this finding.
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/phase2-accounts.md (reported line 152)May include surrounding context.
Then enter your GitHub username and a Personal Access Token (not your password).
### "Updates were rejected because remote contains work"
**Symptom:** `git push` fails with this message
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · references/troubleshooting.md (reported line 189)May include surrounding context.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · README.md (reported line 37)May include surrounding context.
md
| Styling | [Tailwind CSS](https://tailwindcss.com) | Responsive design without custom CSS |
| CMS | [Sanity v3](https://sanity.io) | Edit content without touching code |
| Deployment | [Vercel](https://vercel.com) | Live in 30 seconds, free tier |
| Version Control | [GitHub](https://github.com) | Code backup + auto-deploy trigger |
| Animations | [Framer Motion](https://framer-motion.com) | Smooth, professional motion |
---
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The README describes workflows involving creating accounts, setting up API keys, committing to GitHub, and deploying to Vercel, but it does not prominently warn that these steps can modify external services, publish code, or affect live sites. Even though it mentions storing secrets in .env.local, the missing consent and safety framing increases the risk that users will follow automation-like guidance without understanding system impact. This is more dangerous here because the skill is aimed at non-developers who may rely heavily on the agent's instructions.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The skill directs language selection based on inferred identity ('if their name/context suggests they're Israeli') rather than explicit user preference. This is risky because it relies on sensitive inference, may misclassify users, and can produce intrusive or discriminatory behavior in ways the user did not ask for.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding
The skill instructs use of npx create-next-app@latest, which pulls and executes the latest package version at runtime rather than a reviewed, pinned version. This creates a supply-chain risk: a compromised upstream package or breaking change could lead to execution of untrusted code or unpredictable project setup behavior on the user's machine.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The guide explicitly instructs users to create a Vercel token with no expiration and store it for automation, but it does not immediately warn about the risks of a long-lived bearer credential. If exposed, the token could enable persistent unauthorized deployment or project-management actions, and the website-management context makes this more dangerous because the workflow is normalizing collection of deployment credentials for an external agent-assisted process.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding
The guide tells the user to create a write-capable Sanity Editor token and paste it into local environment configuration without an immediate warning that disclosure would permit content modification. In a website-management skill, this is security-relevant because the token can be used to alter published site content, deface pages, or inject malicious content into the CMS-backed site.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The example explanation is written entirely in Hebrew, and elsewhere the document presents Hebrew-only user-facing phrasing without indicating that language should be selected based on user preference. This can violate a language/locale policy when the skill implicitly assumes a specific language rather than offering opt-in or choice.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs use of npx create-next-app@latest, which pulls and executes the newest package version at runtime rather than a reviewed, fixed version. In a code-generation/build workflow, this increases supply-chain risk because a compromised or breaking upstream release could be executed immediately on the user's machine.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The command npx sanity@latest init --env executes the latest published Sanity CLI version at install time. Because this skill is intended to guide users through real setup steps, unpinned runtime package execution exposes them to supply-chain compromise or unexpected behavior from upstream changes.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding
The deployment instruction npx vercel invokes the latest Vercel CLI without version pinning. In a deployment-focused skill, this is risky because it can execute newly published code with full access to the local repository, environment, and deployment credentials.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The RTL Support section instructs use of <html lang="he" dir="rtl"> and a Hebrew-specific font setup as the default pattern. This forces a specific language/locale in the skill guidance without user opt-in or a documented justification that the skill is only for Hebrew-language sites.
Content
No source excerpt is available for this finding.
Natural-Language Policy Violations
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
Line L004 tells the user to say a specific message in Hebrew whenever an error appears. This forces a specific language output without any user choice or documented region-specific justification, which matches the language/locale policy violation criteria.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · references/troubleshooting.md (reported line 328)May include surrounding context.
Multiple sections provide the primary explanatory and confirmation text in Hebrew, with English translations in parentheses, but the file does not state that the skill is intended only for Hebrew-speaking users or ask the user which language they prefer. That can amount to a locale/language policy issue if the skill defaults to a specific language without opt-in.
Content
No source excerpt is available for this finding.
Excessive Permissions
Low
Category
Privilege Escalation
Confidence
95% confidence
Finding
The instructions direct users to create a Sanity token with Editor permissions, which grants read and write access broader than may be necessary. If that token is exposed, an attacker could modify CMS data and site content; in this skill's context, collecting CMS credentials for site automation increases the likelihood that privileged tokens will be created and retained unnecessarily.
Content
Scanner excerpt · references/phase2-accounts.md (reported line 87)May include surrounding context.
md
3. Go to **API** → **Tokens**
4. Click **"Add API token"**
5. Name: `claude-website-manager`
6. Permission: **"Editor"** (can read and write)
7. Copy the token — paste it in `.env.local`
Also note your **Project ID** — it's visible at the top of the manage page (looks like: `abc123de`)
