Security audit

精英前端设计-专业版

Security checks for vulnerabilities and agentic risk

Overview

This is a frontend design/code-generation skill with broad but disclosed file and command capabilities, and no evidence of hidden persistence, exfiltration, or destructive behavior.

Install only if you want an agent to generate or modify frontend project files. Review any shell commands, npm installs, generated files, and callback/API destinations before allowing them, especially in repositories containing private code or secrets.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill is marketed as a frontend design tool, but its declared capabilities include broad file handling, API integration, command execution, and information retrieval. That capability expansion materially increases attack surface because a user invoking an apparently design-focused skill could trigger privileged behaviors unrelated to its stated purpose, enabling misuse, data access, or system-side effects.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: Documenting system command execution for a frontend design skill is dangerous because it grants a high-risk primitive without a tight functional justification or enforceable scope. If the agent accepts user-influenced parameters for these commands, this can lead to arbitrary command execution, local file access, environment exposure, or persistence actions.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: External service invocation is broader than the skill's stated frontend-design purpose and can be abused for data exfiltration, SSRF-style access through agent networking, or silent transmission of workspace content. The danger is amplified because the documentation does not define what services are allowed or what data may be sent.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are incomplete and vague, which makes accidental activation of a powerful skill more likely. In a skill that also advertises read/write/exec capabilities, ambiguous triggering increases the chance of unintended high-risk operations being run in the wrong context.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill declares read/write/exec tooling but does not provide a strong up-front warning that these are sensitive operations with real side effects. Users may reasonably interpret the skill as a benign design assistant and unknowingly authorize filesystem, network, or command actions that could alter the environment or expose data.

Static analysis

No suspicious patterns detected.