Security audit

精英前端设计-免费版

Security checks for vulnerabilities and agentic risk

Overview

This frontend design skill is mostly design guidance, but it asks for command, file, browser, API, and broad automation capabilities that are not clearly scoped to its stated HTML/CSS purpose.

Install only if you are comfortable reviewing each file, browser, network, or shell action before it runs. The design guidance itself is not malicious, but the skill asks for more operational authority than a simple HTML/CSS design helper clearly needs.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The skill is presented as a frontend/UI design and HTML/CSS generation tool, but the documentation later expands its scope to file handling, API integration, command execution, and information retrieval. That mismatch creates a deceptive capability boundary: a user or orchestrator may invoke it for a seemingly low-risk design task while the skill actually has much broader operational reach.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: This skill exposes command-execution capability even though its stated purpose is design guidance and HTML/CSS output. Unnecessary exec access increases the attack surface significantly, because any prompt-injection or misuse path could pivot from content generation into shell command execution.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: The skill claims API integration/external service use despite being described primarily as a local-style design rules and code output tool. Unnecessary network capability can expose prompts, project context, or generated artifacts to third parties and enables unexpected data exfiltration paths.

Intent-Code Divergence

Medium

Confidence: 80% confidence
Finding: The documentation says the skill is pure Markdown-driven and needs no extra API key, yet elsewhere it advertises API integration and command execution. These contradictions obscure the real operating model, making it harder for users and policy systems to assess risk and easier for unsafe behavior to slip through under a benign description.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are broad and ambiguous, covering general design, UI, poster, and brand-visual scenarios without precise boundaries. Overbroad invocation increases the chance that the skill is selected in contexts where its hidden exec/network/file capabilities are unnecessary, causing unintended tool use.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill advertises file processing, API integration, and command execution without prominent user-facing warnings proportional to their impact. Users may reasonably assume a design helper only generates markup, not that it can access files, execute commands, or communicate externally.

Static analysis

No suspicious patterns detected.