ClawHub
Back to skill

Security audit

Anthropics Frontend Design Free

Security checks for vulnerabilities and agentic risk

Overview

This frontend-design skill is not clearly malicious, but it asks for broader file and command powers than its simple HTML/CSS/JS purpose explains.

Review this skill before installing. It may be useful for generating simple frontend pages, but you should only run it in an environment where broad file writes and shell command execution are acceptable, and avoid providing API keys or sensitive project files unless the publisher clarifies the exact services, commands, and file paths it needs.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

High
Confidence
94% confidence
Finding
The skill is presented as a narrowly scoped HTML/CSS/JS frontend design generator, but later advertises generic file processing, API integration, and command execution capabilities. This scope expansion is dangerous because it can cause an agent or user to treat the skill as authorized to access files, invoke external services, or run shell commands unrelated to the stated design task, increasing the attack surface for prompt injection and unintended privileged actions.

Intent-Code Divergence

Medium
Confidence
82% confidence
Finding
The document says the skill only supports basic HTML/CSS/JS generation and excludes broader framework functionality, but later workflow text treats command execution, API calls, and file operations as normal supported behavior. These contradictions create unsafe operator expectations and can lead an agent to grant or use higher-risk capabilities than the user would reasonably infer from the skill's stated scope.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
Declaring exec capability for a basic frontend design/code-generation skill is unjustified by the business purpose described in the document. Unnecessary command execution materially increases risk because any downstream prompt injection, misuse, or misunderstanding could turn a simple content-generation workflow into local command execution with access to the agent environment.

Static analysis

No suspicious patterns detected.