Security audit

Frontend UI Pipeline

Security checks for vulnerabilities and agentic risk

Overview

This is a benign frontend planning skill made of Markdown guidance, with only a bounded design-record file update disclosed as part of its workflow.

Installers should understand that this skill is a planning and documentation workflow. It may ask an agent to create or update DESIGN.md in the project or feature root when frontend work is created or changed, so review that generated design record like any other workspace file change.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · references/pipelines/saas-dashboard-pipeline.md (reported line 37)May include surrounding context.
md
- Strong hierarchy between summary and detail - Fast scanning for metrics, tables, and actions - Stable layout under loading and filtering - Clear state design for empty/error/loading/success - Keyboard and focus friendliness for repeated use ## Step 5. Review priorities

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: These example prompts are broad, natural-language requests like 'Help me figure it out' and 'need help turning it into a frontend project plan,' which can overlap with many ordinary product or website conversations. In an agent-routing system, that ambiguity can cause the skill to activate too often, leading to unintended access to this workflow, misrouting, or application of frontend-planning behavior where a narrower skill should have been selected.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The prompt-writing tips and formula define a very flexible invocation pattern but do not establish clear boundaries for what should not activate this skill. That makes routing easier to spoof or accidentally trigger with generic requests about products, style, or planning, increasing the chance of cross-skill confusion and unintended execution paths.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest says this skill is a frontend UI workflow for turning ideas and feedback into buildable frontend plans, but this file is explicitly a 'Mobile App Pipeline' focused on iOS, Android, and cross-platform mobile app design. That is a material scope mismatch because the documented behavior targets mobile product planning rather than the declared frontend UI pipeline purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation guidance says to use this skill when the user wants an app dashboard, product workspace, analytics surface, team tool, or operational UI. Several of these phrases are broad and overlapping with common product-design requests, without clear boundaries or exclusion criteria for when this pipeline should not be used.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states that the skill may create or update DESIGN.md, but it does not clearly warn users up front that invoking the skill can modify repository files. In an agentic environment, undocumented write behavior can lead to surprising file changes, accidental overwrites, or commits of generated content that users did not intend to add.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: This markdown file states that the workflow output may include 'created or modified files' and a generated 'DESIGN.md', which are user-impacting filesystem changes. The surrounding description presents these outputs as expected behavior but does not include a clear warning or disclosure about modifying project files.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.