Web Design Guidelines

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:27 AM UTC
• Version: 1.0.0

Overview

This UI review skill is not malicious, but it relies on mutable remote instructions that can change the skill's behavior after installation.

Install only if you are comfortable with each review depending on live content from the referenced GitHub URL. Prefer a version that vendors the guidelines locally or pins them to a reviewed commit and treats remote text as reference material rather than agent instructions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:22

Finding

Mutable Remote Instructions Can Hijack Skill Behavior and Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22–35
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown

1. Fetch the latest guidelines from the source URL below
2. Read the specified files (or prompt user for files/pattern)
3. Check against all rules in the fetched guidelines
4. Output findings in the terse `file:line` format

## Guidelines Source

Fetch fresh guidelines before each review:

https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md

text

Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.

Technical Analysis

The skill directs the agent to retrieve a mutable file from an external URL during every review and treat its contents as authoritative rules and output-format instructions. The retrieved instructions are not version-pinned, cryptographically verified, or constrained by a locally defined schema.

Consequently, the effective behavior of the skill can change after the package has been audited. Anyone able to modify the upstream repository or compromise its delivery path could place prompt-injection instructions in command.md. Because SKILL.md explicitly directs the agent to apply all fetched rules and follow their output instructions, malicious remote text may redirect the review, suppress findings, manipulate the response, or induce unrelated tool operations.

This is instruction retrieval rather than confirmed executable-code retrieval, so the best matching classification is T01: Skill Instruction Hijacking, not remote payload execution.

Attack Path

1. An attacker compromises, gains authorized write access to, or otherwise influences the remotely hosted command.md.
2. The attacker inserts instructions that alter the review objective, request unrelated operations, conceal findings, or redefine the outp ...[truncated 1276 chars]

Remediation

View remediation

Remediation Suggestions

1. Vendor a reviewed copy of the guidelines into the skill package instead of fetching mutable instructions during each invocation.
2. If remote retrieval is operationally necessary, use an immutable commit-specific URL rather than a branch-based main URL.
3. Verify the downloaded content against a cryptographic digest recorded in the audited package.
4. Treat fetched material as untrusted reference data, not as agent instructions. Explicitly prohibit it from redefining goals, invoking tools, changing safety constraints, or controlling the final output format.
5. Define the review procedure and output schema locally in SKILL.md; parse remote content only into a narrowly validated rules structure.
6. Reject retrieved content containing operational directives outside the expected guideline schema.
7. Apply least privilege to WebFetch and file-reading tools, restrict network access to approved hosts, and prevent remote content from authorizing additional network or system operations.
8. Add provenance logging for the exact guideline version and digest used in each review so results remain reproducible and auditable.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises itself for very broad triggers such as 'review my UI', 'review UX', 'check accessibility', layout, typography, color, CSS debugging, and dashboard UI work. This overlap with common user requests can cause the skill to auto-activate in many contexts, increasing the chance that untrusted remote instructions from the fetched guidelines are pulled into unrelated sessions and that the skill supersedes more appropriate, narrower tools.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.