ClawHub
Back to skill

Security audit

设计

Security checks for vulnerabilities and agentic risk

Overview

This UI-design skill is mostly a markdown guide, but it asks for shell execution and generic API-key handling without tightly explaining or limiting those powers.

Review this skill before installing if you do not want a design skill to have shell execution authority. If installed, use it only for explicit frontend work, avoid providing secrets unless a specific trusted service is named, and require user approval for any command execution.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill requests `exec` capability even though its stated purpose is frontend UI design and code generation, which can be accomplished with read/write alone in most cases. Unnecessary shell execution expands the attack surface significantly because prompt-controlled or generated content could be routed into command execution paths, enabling arbitrary local actions on the host agent environment.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The documentation introduces API key handling and external/API usage despite the skill being described as a frontend design/code generation skill with no clear operational need for outbound access or secret management. This mismatch increases the likelihood of unnecessary secret exposure, unintended data exfiltration, or future implementation drift where the skill begins using networked services without adequate justification or controls.

Intent-Code Divergence

Low
Confidence
83% confidence
Finding
Labeling the skill as `MD+execute()` conflicts with its advertised frontend design purpose and normalizes execution capability where users would expect content generation only. This kind of misleading capability framing can cause reviewers or operators to underestimate the risk profile and approve a skill with stronger privileges than its business function requires.

Vague Triggers

Medium
Confidence
80% confidence
Finding
The activation text is very broad, covering webpages, dashboards, components, posters, branding, and general creative/design requests, which can cause the skill to trigger in many contexts beyond a narrow intended scope. Overbroad activation increases the chance that a highly privileged skill is invoked unnecessarily, exposing read/write/exec capabilities in conversations where they are not needed.

Static analysis

No suspicious patterns detected.