ClawHub
Back to skill

Security audit

Material Design 3 Ui

Security checks for vulnerabilities and agentic risk

Overview

The skill provides coherent interface-design guidance, with disclosed installation behavior and a remote-install shortcut that warrants care.

Review a local copy pinned to a specific commit instead of using the remote execution shortcut. Select only the agent you need, such as --agent openclaw. Back up local edits before using --force, and remember that uninstall removes this skill's copies across all supported agent locations.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The pipe sends fetched content directly to Bash, turning an unverified remote response into executable instructions. This confirms the same supply-chain execution risk identified by SC2, rather than a separate chaining exploit or evidence of malicious tool orchestration; installation is legitimate, but immediate execution is unnecessarily risky.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

macOS / Linux

bash
curl -fsSL https://raw.githubusercontent.com/skydashnet/material-design-3-ui-skill/main/install.sh | bash

Windows PowerShell

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 301)May include surrounding context.

md
|--------------------|-------------------------------------------------------------------|
| Claude Code        | `~/.claude/skills/material-design-3-ui/`                          |
| OpenAI Codex       | `~/.agents/skills/material-design-3-ui/`                          |
| Google Antigravity | `~/.gemini/config/skills/material-design-3-ui/`                   |
| Kiro               | `~/.kiro/skills/material-design-3-ui/`                            |
| OpenCode           | `~/.config/opencode/skills/material-design-3-ui/`                 |
| Hermes Agent       | `~/.hermes/skills/material-design-3-ui/`                          |

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The supplied code is a package installer, not a UI design or implementation tool. Its primary observable behavior is downloading and deploying agent skills, with filesystem changes across multiple agent environments. Although installation can support the advertised skill, this standalone deployment capability is not represented in the declared description. The script contains path-validation safeguards and does not execute downloaded package contents; no malicious behavior is established. The actual Material Design functionality cannot be assessed because the installed skill content is not supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The only supplied command is ./uninstall.sh, which does not demonstrate any declared Material Design capability and instead invokes an apparent uninstall operation. No connection to supporting the declared purpose is shown. The script's name suggests uninstallation, but specific removals or other side effects cannot be established without its contents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The supplied command performs remote code installation and execution rather than any demonstrated Material Design UI/UX work. Although installation could support the declared purpose, executing a remote script is a substantial capability not disclosed in the description. The script's contents are not supplied, so its downstream actions and whether they support the stated purpose cannot be verified; no malicious behavior is established.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · install.sh (reported line 163)May include surrounding context.

sh
case "$1" in
    claude)      printf '%s\n' "${HOME_DIR}/.claude/skills/${SKILL_ID}" ;;
    codex)       printf '%s\n' "${HOME_DIR}/.agents/skills/${SKILL_ID}" ;;
    antigravity) printf '%s\n' "${HOME_DIR}/.gemini/config/skills/${SKILL_ID}" ;;
    kiro)        printf '%s\n' "${HOME_DIR}/.kiro/skills/${SKILL_ID}" ;;
    opencode)    printf '%s\n' "${HOME_DIR}/.config/opencode/skills/${SKILL_ID}" ;;
    hermes)      printf '%s\n' "${HOME_DIR}/.hermes/skills/${SKILL_ID}" ;;

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · uninstall.sh (reported line 11)May include surrounding context.

sh
DESTS=(
  "${HOME_DIR}/.claude/skills/${SKILL_ID}"
  "${HOME_DIR}/.agents/skills/${SKILL_ID}"
  "${HOME_DIR}/.gemini/config/skills/${SKILL_ID}"
  "${HOME_DIR}/.kiro/skills/${SKILL_ID}"
  "${HOME_DIR}/.config/opencode/skills/${SKILL_ID}"
  "${HOME_DIR}/.hermes/skills/${SKILL_ID}"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · install.sh (reported line 179)May include surrounding context.

sh
codex)
      command -v codex >/dev/null 2>&1 || [[ -d "${HOME_DIR}/.codex" || -d "${HOME_DIR}/.agents" ]] ;;
    antigravity)
      command -v agy >/dev/null 2>&1 || [[ -d "${HOME_DIR}/.gemini/config" ]] ;;
    kiro)
      command -v kiro-cli >/dev/null 2>&1 || command -v kiro >/dev/null 2>&1 || [[ -d "${HOME_DIR}/.kiro" ]] ;;
    opencode)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

md
- reproduce semantics and token relationships, not Android-specific quirks,
- preserve native platform accessibility and input conventions,
- mark custom implementations clearly,
- do not claim official platform availability without verification.

## Final principle

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 17)May include surrounding context.

text
in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The recommended command retrieves an installer from a mutable main branch and immediately executes it without content verification or a review opportunity. Repository compromise or an unauthorized upstream change could therefore execute arbitrary code with the invoking user's permissions, including access to local projects and agent configuration. The explicit security warning and alternative installation method reduce concern about malicious intent but do not protect users of the quick-install command.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

macOS / Linux

bash
curl -fsSL https://raw.githubusercontent.com/skydashnet/material-design-3-ui-skill/main/install.sh | bash

Windows PowerShell

Static analysis

No suspicious patterns detected.