精英前端设计-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.3

Overview

The skill is mostly a frontend design helper, but it asks for command execution and browser-style capabilities without a clear, narrow need or enforceable limits.

Install only if you are comfortable with the host platform constraining command execution and browser/network access. For normal frontend design help, prefer a version that keeps permissions to Markdown guidance or read-only project inspection, or require explicit confirmation before any command, file mutation, or external network use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:6

Finding

Excessive Command Execution and Browser Permissions for a UI Design Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6 and 18–22
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - browser

Technical Analysis

The skill is documented as a Markdown-driven frontend design assistant that generates HTML and CSS based on typography, color, layout, and animation rules. This legitimate function does not require unrestricted system-command execution or general browser access.

The metadata nevertheless requests the exec tool and separately declares the browser tool. The document also makes broad claims later in the file about command execution, external API integration, and file processing, but it does not define enforceable restrictions such as:

• An explicit command allowlist
• Fixed command arguments
• Restricted working directories
• Read-only file-system boundaries
• Approved network destinations
• Browser domain allowlists
• Runtime sandbox policies

Although the security guidance states that only allowlisted commands should be executed, this is an advisory statement rather than an implemented control. No actual allowlist or validation mechanism is provided.

This violates the principle of least privilege. An agent platform that grants tools according to the skill metadata could expose command execution and network-capable browser functionality to a skill whose stated task only requires text generation.

Attack Path

1. An agent loads SKILL.md and grants the tools declared by its metadata.
2. The skill receives exec, file-reading, and potentially browser capabilities.
3. An attacker supplies a crafted design request containing instructions that influence generated tool actions or command arguments.
4. Because the skill defines no enforceable command, argument, path, or destination restrict ...[truncated 1131 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and browser from the skill metadata because HTML/CSS generation can be performed without those capabilities.
2. Retain only read-only access if the skill must inspect existing frontend files. Otherwise, declare no tools.
3. Remove unsupported generic claims about command execution, arbitrary file processing, and external API integration.
4. If command execution is genuinely required for a narrowly defined operation:
   • Implement an enforceable allowlist of exact executables.
   • Use fixed arguments rather than user-controlled command strings.
   • Reject shell metacharacters and prohibit shell interpretation.
   • Restrict execution to a dedicated sandbox with minimal privileges.
   • Limit access to a designated project directory.
   • Prevent access to credentials, environment secrets, and sensitive host paths.
   • Require explicit user confirmation before each execution.
5. If browser access is required, enforce an HTTPS-only domain allowlist and prohibit arbitrary navigation, downloads, and credential-bearing requests.
6. Keep tool declarations consistent: the top-level allowed-tools field and the separate tools list currently disagree about browser access.
7. Add automated policy tests that fail publication when a skill requests capabilities not directly required by its documented purpose.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly states '支持中文交互', presenting Chinese as the interaction language, but does not mention user choice or opt-in for other languages. This is a natural-language locale policy concern because it imposes a language constraint without documented justification or flexibility.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger condition is broad enough to match many ordinary design-related requests, which increases the likelihood that the skill will be auto-selected outside a narrowly intended context. Because the skill also declares elevated capabilities such as exec and browser access, overbroad routing makes accidental or abusive invocation more dangerous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill declares exec capability even though its stated purpose is design guidance and HTML/CSS generation, which normally does not require shell access. Unnecessary command execution privileges are dangerous because they allow the skill to run local commands if triggered, turning a low-risk design helper into a tool with system-level side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a frontend/UI design and HTML/CSS generation tool, but later expands its scope into generic automation, file processing, API integration, command execution, and information retrieval. This scope drift is dangerous because it can cause an agent to invoke the skill for broad operational tasks unrelated to design, increasing the attack surface and enabling misuse of privileged tools under misleading branding.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document claims the skill is purely Markdown-driven and needs no extra API key, yet elsewhere describes API integration, browser/network use, and command execution. These contradictory statements reduce operator trust and can obscure the real privileges and behaviors of the skill, making security review and safe deployment harder.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.