Security audit

设计

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a frontend code-generation helper, but its broad activation scope and shell-command capability deserve review before installation.

Install only if you are comfortable with the skill being able to read and write project files and potentially run local commands during frontend work. Use it in a project-scoped workspace, avoid giving it secrets unless clearly needed, and review any proposed shell command before allowing execution.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a frontend UI/code-generation tool, but it declares read, write, and exec capabilities that materially exceed what is needed for simple HTML/CSS/JS generation. This capability mismatch expands the attack surface and could let prompt-influenced workflows mutate files or run local commands under the guise of a design task.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Arbitrary command execution is not justified by the documented purpose of generating frontend code and creates a direct path to local system abuse if the agent is induced to execute shell commands. In this context, exec can enable file deletion, environment inspection, credential access, or downloading/running secondary payloads.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The API key setup and network-security guidance imply external-service interaction beyond the stated UI design scope, increasing the chance that the skill handles secrets or performs remote operations without a clear necessity. This broadens exposure to credential leakage, unintended data exfiltration, or misuse of external APIs from a skill that should primarily generate local frontend artifacts.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The request/response schema describes a generic content-processing interface rather than a narrowly scoped frontend design contract, making it easier to justify unrelated actions or ambiguous handling of arbitrary input. Ambiguous interfaces are dangerous in agent skills because they weaken policy boundaries and can mask misuse of powerful tools behind broad 'processing' semantics.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The activation description is overly broad and mixes UI design with generic creative and branding tasks, which raises the likelihood of the skill being invoked in contexts it was not safely designed for. Overbroad triggering is particularly risky here because the skill also declares powerful capabilities, so accidental activation could expose file or execution functions during unrelated requests.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The summary trigger wording is broad enough to match many common frontend-adjacent requests, increasing collision with normal user prompts and causing unnecessary invocation. In a skill with write and exec capabilities, such ambiguity makes unintended tool exposure more dangerous than it would be for a read-only or purely advisory skill.

Static analysis

No suspicious patterns detected.