Security audit
Security checks for vulnerabilities and agentic risk
This is a mostly coherent HTML explainer skill, but its broad auto-use and self-update paths can change local state and future agent behavior in ways users should review first.
Install only if you are comfortable with the agent generating and storing local HTML pages proactively. Review generated pages before sharing because they may embed local code or images. Treat the update command as high trust: run it only when you trust the publisher/source, and consider disabling background update checks or browser auto-open if you want less local state and network activity.
The description tells the agent to use the skill 'proactively and liberally' and 'when in doubt, use it' for many normal response types. This is dangerous because it drives unnecessary tool invocation, increasing exposure to file reads, rendering side effects, and permission/path handling in situations that do not require them.
The skill includes an 'update this skill' pathway that instructs the agent to follow external settings/update guidance. Any self-modification or update flow is risky because it can change future behavior, introduce unreviewed content, or be abused to escalate capabilities through fetched or altered instructions.
Arguments for this call: `$ARGUMENTS`
When the arguments start with `config`, `clean` or `update`, or the user asks to change a setting, clean up pages or update this skill: read `${CLAUDE_SKILL_DIR}/references/settings.md` and follow it. That turn produces no page.
## 1. Decide: produce a page or not
The always-on mode lowers the threshold so far that ordinary conclusions, summaries, plans, and explanations trigger page generation. That creates a persistent bias toward tool use and file creation on routine turns, which can leak local paths, consume resources, and normalize unnecessary side effects.
Referenced artifact was not completely inspected
The CLI is bundled in this skill's directory: `scripts/am.mjs`, a single file with no dependencies to install; it needs only Node.js 20+. If `node` is not found
The skill contains explicit self-update instructions, including npx skills update, claude plugin update, git pull && npm install, and dsh plugin ... up. Self-modification is high risk because it changes the skill's own code and dependencies, and several listed paths pull and execute remote content; if triggered by a prompt or performed automatically, this can become a direct supply-chain and persistence vector.
When the arguments start with `clean`, or the user asks to clean up pages / the cache: first run `am clean --dry-run` and tell the user how many items and how much space will be deleted. Run `am clean` only after the user agrees (add `--all` to delete all pages and videos, `--days N` to change how many days to keep).
When the arguments start with `update`, or the user asks to update this skill: update according to how it was installed. Installed with `npx skills`: run `npx skills update answer-me-with-html -y`. Installed as a Claude Code plugin: run `claude plugin update answer-me-with-html@answer-me-with-html` (or ask the user to click Update now in `/plugin` → Installed), then ask the user to run `/reload-plugins`. Installed with git clone: run `git pull && npm install` in the repository directory. Installed as a DSH plugin: run `dsh plugin --profile <name> up <package>`, with the profile and package names read out of the copy's own path (`~/.dsh/profiles/<name>/node_modules/<package>/…`); when the CLI prints an `! Update hint` or the page shows a new-version button, the exact command is already filled in — use it as printed.
The skill directs the agent to read files, inspect environment-dependent paths, and potentially use network-relevant update flows, but it declares no explicit tool scope or allowed-tools boundary. That increases the chance the host grants broader capabilities than necessary, making accidental file access or other side effects more likely.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Answer me with HTML: answer a complex question with one HTML page
You write only the **content draft** (extended Markdown). The `am` CLI does all layout, colours, dark mode and diagram coordinates. **Do not hand-write HTML / CSS / SVG.**
Reply to the user, and write the draft, in the user's language.
The theme-install flow says to run am theme add <name> --use and notes that it downloads, checks, saves, and activates a theme without asking the user anything else. That performs network retrieval and local file writes/config changes without an explicit user-facing warning about those side effects, increasing the risk of surprising state changes or installing untrusted content.
This is the same unpinned npx skills updater reference at the same location, so it carries the same risk: remote package resolution at runtime can execute unexpected code from a changed or compromised upstream package. In an agent skill, this is especially relevant because the instruction is framed as an operational step the agent may perform automatically.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# Explainer videos (am video, 3Blue1Brown style)
Read this when SKILL.md section 7 sends you here. `am` means the full `node ".../scripts/am.mjs"` command from SKILL.md section 2; write the path out in full, because `${CLAUDE_SKILL_DIR}` is not replaced in this file.
A video draft has the same format as a page draft, with one extra rule: lines starting with `>` are narration, one beat per line.
Line L32 instructs the writer to use Chinese transition phrases and gives Chinese-language examples as the normative narration style. This imposes a specific language/locale preference in the skill instructions without indicating user choice or opt-in, which matches the language policy violation category.
The script can transmit user-supplied narration text to the external ElevenLabs API for voice synthesis. In the context of an HTML explainer skill, this is more dangerous because users may not expect their content to leave the local machine, and the transfer may include sensitive draft material embedded in video narration.
id: `elevenlabs:${voice}:${model}`,
concurrency: 2,
async synth(text2) {
const url = `https://api.elevenlabs.io/v1/text-to-speech/${voice}?output_format=pcm_${SAMPLE_RATE}`;
let res;
try {
res = await fetch(url, {
The manifest describes a skill for producing one-page visual HTML explainers, but this CLI also launches Chrome via DevTools and exports MP4/WebM video files. Video generation and browser automation are materially broader capabilities than straightforward HTML page building and are not obviously required to fulfill the stated HTML-explainer purpose from the manifest.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The CLI imports language packs for multiple locales, but when no language is declared the detector defaults Han text to "zh" (Simplified Chinese). This imposes a specific language/script choice on users with Chinese content, including Traditional Chinese users, without explicit opt-in or prior choice.
The CLI can start an HTTP server, generate capability-style links, and optionally expose pages over LAN or a public origin. In a skill presented as a local HTML page builder, this materially expands the attack surface: rendered content becomes remotely retrievable if a user runs the serve path, and the code even supports externally reachable origins and secret-bearing links.
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
DISCLAIMER
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
The CLI launches the rendered file via platform open commands, which triggers external application execution on the user's system. Although configurable, this execution path itself has no immediate prompt or runtime disclosure in the code path where it occurs.
Detected: suspicious.dangerous_exec, suspicious.env_credential_access