Security audit

X Design

Security checks for vulnerabilities and agentic risk

Overview

This design skill is not clearly malicious, but it needs review because it overstates bundled resources and includes mutable install and remote-code guidance.

Install only from a reviewed, immutable package or commit, and avoid following the unpinned npx command as written. Expect this skill to create and edit local visual artifacts and to use network access for brand assets; review generated HTML before opening or sharing it if it includes CDN scripts or Claude/browser integrations.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: deck-studio/README.md:49
Finding: Unpinned Remote Skill Installation Creates a Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Warning

Location: references/technical-specs.md:24
Finding: Generated Artifacts May Execute Remote Animation Code Without Integrity Verification
Content: View full analysis
Remediation: View remediation
``` 4. Independently calculate and verify the integrity hash against a trusted package artifact before documenting it. 5. Add a restrictive Content Security Policy that limits `script-src` to local resources and explicitly approved hashes. 6. Ensure exported self-contained artifacts bundle all JavaScript rather than retrieving executable code at viewing time. 7. Fail closed if integrity verification fails; do not retry from an unverified alternative CDN. 8. Record dependency versions, checksums, provenance, and update-review procedures in a dependency manifest. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (50)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is instructed to activate for an extremely broad class of requests, including vague asks, and to prefer itself over generic tools. That kind of aggressive routing can cause the agent to over-invoke the skill outside its safest/intended scope, increasing the chance of prompt hijacking, misrouting, or bypass of more appropriate specialized controls.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
The current `SKILL.md` directory is `<skill-base>` (i.e. `XDesign/`). Every bundled resource (`references/`, `assets/`, `deck-studio/`, `scripts/`, `evals/`) re

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · deck-studio/README.md (reported line 9)May include surrounding context.
md
> (27 个 CSS + 20 个 Canvas FX)，加上全新的 **演讲者模式** —— 像素级 > 完美预览 + 逐字稿提词器 + 计时器。纯静态 HTML/CSS/JS，无需构建。 **作者：** lewis <sudolewis@gmail.com> **协议：** MIT **English docs:** [README.md](README.md)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · deck-studio/README.md (reported line 234)May include surrounding context.
md
> (27 个 CSS + 20 个 Canvas FX)，加上全新的 **演讲者模式** —— 像素级 > 完美预览 + 逐字稿提词器 + 计时器。纯静态 HTML/CSS/JS，无需构建。 **作者：** lewis <sudolewis@gmail.com> **协议：** MIT **English docs:** [README.md](README.md)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · deck-studio/README.zh-CN.md (reported line 8)May include surrounding context.
md
> (27 个 CSS + 20 个 Canvas FX)，加上全新的 **演讲者模式** —— 像素级 > 完美预览 + 逐字稿提词器 + 计时器。纯静态 HTML/CSS/JS，无需构建。 **作者：** lewis <sudolewis@gmail.com> **协议：** MIT **English docs:** [README.md](README.md)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · deck-studio/README.zh-CN.md (reported line 238)May include surrounding context.
md
> (27 个 CSS + 20 个 Canvas FX)，加上全新的 **演讲者模式** —— 像素级 > 完美预览 + 逐字稿提词器 + 计时器。纯静态 HTML/CSS/JS，无需构建。 **作者：** lewis <sudolewis@gmail.com> **协议：** MIT **English docs:** [README.md](README.md)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · deck-studio/SUBMODULE.md (reported line 225)May include surrounding context.
md
> (27 个 CSS + 20 个 Canvas FX)，加上全新的 **演讲者模式** —— 像素级 > 完美预览 + 逐字稿提词器 + 计时器。纯静态 HTML/CSS/JS，无需构建。 **作者：** lewis <sudolewis@gmail.com> **协议：** MIT **English docs:** [README.md](README.md)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · deck-studio/references/presenter-mode.md (reported line 119)May include surrounding context.
md
</aside> </section>  </div> <script src="../../../assets/runtime.js"></script>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · deck-studio/references/presenter-mode.md (reported line 119)May include surrounding context.
md
</aside> </section>  </div> <script src="../../../assets/runtime.js"></script>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/deck-studio-catalog.md (reported line 175)May include surrounding context.

...

...
```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/deck-studio-catalog.md (reported line 175)May include surrounding context.

...

...
```

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/integration-guide.md (reported line 88)May include surrounding context.
XDesign 的 references/ 引用 assets/，但 deck-studio 把资源放在自己的 deck-studio/assets/。绝对不要在 XDesign 的根目录里复制 assets——双份资源会导致主题/动画版本不一致。

html
 <link rel="stylesheet" href="assets/themes/aurora.css">

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/integration-guide.md (reported line 88)May include surrounding context.
XDesign 的 references/ 引用 assets/,但 deck-studio 把资源放在自己的 deck-studio/assets/。绝对不要在 XDesign 的根目录里复制 assets——双份资源会导致主题/动画版本不一致。

html
 <link rel="stylesheet" href="assets/themes/aurora.css">

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/integration-guide.md (reported line 184)May include surrounding context.
bash
# 1. 删除旧的（保留自定义 examples） rm -rf deck-studio/assets deck-studio/templates deck-studio/references rm deck-studio/SKILL.md deck-studio/README.md deck-studio/LICENSE # 2. 重新克隆 / 下载 # （参见 tasks 目录下的 history）

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/integration-guide.md (reported line 185)May include surrounding context.
bash
# 1. 删除旧的（保留自定义 examples） rm -rf deck-studio/assets deck-studio/templates deck-studio/references rm deck-studio/SKILL.md deck-studio/README.md deck-studio/LICENSE # 2. 重新克隆 / 下载 # （参见 tasks 目录下的 history）

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 85% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/mode-2-prototype.md (reported line 20)May include surrounding context.
md
1. **Acknowledge** the rule exists and why: "The convention is to avoid purple gradients because they've become an AI tell, but since you're asking for it..." 2. **Ask once** if they're genuinely aware: "Just confirming — you want this despite it reading as default AI style?" 3. **Honor the request** if they confirm. Document the override in the HTML reasoning block. 4. **Move on**. Don't lecture, don't warn a second time. **The only non-negotiable exceptions** — these are safety/accessibility hard requirements, not style preferences: - Color contrast ratios (WCAG AA)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/mode-2-prototype.md (reported line 166)May include surrounding context.
HTML reasoning block (include at the top of every file)

html
<!-- DESIGN REASONING ================ Target audience: [who sees this]

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The markdown instructs the agent to tell the user a fixed Chinese sentence when structured data is detected. This imposes a language choice without user opt-in and may conflict with language or locale policies for users operating in other languages.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill should not be used for "resume review" or non-visual text tasks, establishing a clear scope boundary. However, the routing table introduces a broad Review Mode for auditing arbitrary HTML and uses generic review triggers such as "review" and "audit," which can justify using the skill for review-style requests despite the manifest's prohibition on resume review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Review Mode uses broad triggers such as 'review', 'audit this', and 'polish pass', which overlap with many general-purpose user requests. In an agent setting, ambiguous triggers can unexpectedly capture unrelated tasks, causing the skill to take over flows it was not meant to handle and potentially suppress safer task-specific behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The fallback behavior maps vague requests directly into concrete modes instead of requiring strong confirmation in all ambiguous cases. This can let underspecified user input steer the agent into generating substantial outputs under the wrong mode, which is a prompt-scope problem that can be abused to trigger unintended capabilities or degrade reliability safeguards.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The invocation examples are very broad and encourage the agent to use this skill for many loosely defined visual-design requests without clear trigger boundaries or safety exclusions in the README. In an agentic environment, overbroad routing can cause the skill to activate unexpectedly, increasing the chance of inappropriate tool use, unintended content transformation, or chaining into other risky capabilities.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The description says to use the skill when the user asks for a presentation, deck, slideshow, or 'any kind of multi-slide pitch/report/sharing document,' and lists many common terms like 'presentation' and 'slides'. This is broad enough to overlap with ordinary requests and does not provide negative examples or constraints clarifying when the skill should not activate.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T03 · Remote Payload Retrieval and Execution

SkillSpector

Vague Triggers

Ae1

Chaining Abuse

Chaining Abuse

Chaining Abuse

Chaining Abuse

Chaining Abuse

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Hidden Instructions

Tool Parameter Abuse

Tool Parameter Abuse

Anti-Refusal Statement

Hidden Instructions

HTML reasoning block (include at the top of every file)

Natural-Language Policy Violations

Context-Inappropriate Capability

Vague Triggers

Vague Triggers

Vague Triggers

Vague Triggers

Rp1

Rp1

Static analysis