Security audit

设计

Security checks for vulnerabilities and agentic risk

Overview

This UI-design skill is mostly a markdown guide, but it asks for shell execution and generic API-key handling without tightly explaining or limiting those powers.

Review this skill before installing if you do not want a design skill to have shell execution authority. If installed, use it only for explicit frontend work, avoid providing secrets unless a specific trusted service is named, and require user approval for any command execution.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill requests exec capability even though its stated purpose is frontend UI design and code generation, which can be accomplished with read/write alone in most cases. Unnecessary shell execution expands the attack surface significantly because prompt-controlled or generated content could be routed into command execution paths, enabling arbitrary local actions on the host agent environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation introduces API key handling and external/API usage despite the skill being described as a frontend design/code generation skill with no clear operational need for outbound access or secret management. This mismatch increases the likelihood of unnecessary secret exposure, unintended data exfiltration, or future implementation drift where the skill begins using networked services without adequate justification or controls.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: Labeling the skill as MD+execute() conflicts with its advertised frontend design purpose and normalizes execution capability where users would expect content generation only. This kind of misleading capability framing can cause reviewers or operators to underestimate the risk profile and approve a skill with stronger privileges than its business function requires.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The activation text is very broad, covering webpages, dashboards, components, posters, branding, and general creative/design requests, which can cause the skill to trigger in many contexts beyond a narrow intended scope. Overbroad activation increases the chance that a highly privileged skill is invoked unnecessarily, exposing read/write/exec capabilities in conversations where they are not needed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.