前端设计-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.1

Overview

This is a frontend design guidance skill, but it asks for command execution and file-writing authority despite saying it is Markdown-only and does not need shell access.

Review this skill before installing in any environment where shell commands or file writes are broadly enabled. It appears to be design guidance rather than malware, but its permissions should be reduced to read-only or tightly scoped writing unless you explicitly want it to modify frontend project files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:5

Finding

Unnecessary Command Execution and File-Write Capabilities Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5 and 17–20; the contradictory capability statement appears at line 265
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

Complete Code Snippet

yaml

allowed-tools: read exec

yaml

tools:
  - exec
  - read
  - write

The skill later states:

markdown

- **Category**: MD (pure Markdown instructions, no exec command-line capability required)

Technical Analysis

The skill describes itself as a pure Markdown frontend-design guide and explicitly states that it does not require command-line execution. Nevertheless, its metadata requests both exec and write capabilities. The write capability is also listed under tools but omitted from allowed-tools, creating an inconsistent and ambiguous permission declaration.

These capabilities exceed the skill's legitimate requirements. Design guidance and code generation can be delivered as textual output without arbitrary command execution. If reading project context is required, read alone is sufficient. Granting exec exposes a local command-execution channel, while write may permit modification of files accessible to the hosting agent.

The error-handling section also recommends running ping, which could encourage use of the otherwise unnecessary execution capability. The audited file does not contain an automatically executed malicious command, credential-stealing logic, persistence mechanism, or remote payload retrieval. The risk arises from excessive authority that could be misused when processing attacker-controlled prompts.

Attack Path

1. A user or untrusted project supplies crafted design, implementation, or troubleshooting instructions.
2. The agent loads this skill with the declared exec and write tools available.
3. The crafted input persuades the agent to treat a shell command or file modification as part of frontend implementation or connectivity troubleshooting.
4. The ag ...[truncated 1058 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec because the skill explicitly identifies itself as Markdown-only and does not need command-line execution.
2. Remove write unless direct artifact creation is an essential, documented feature.
3. Retain only the minimum required capability, such as read, and make allowed-tools and tools consistent.
4. If file generation is required, replace unrestricted writing with a workspace-scoped output API that blocks path traversal, symlink escapes, and writes outside a designated directory.
5. If command execution becomes strictly necessary, use an explicit allowlist with fixed arguments. Never concatenate user-controlled values into shell commands.
6. Replace the recommendation to invoke ping with host-provided network diagnostics that do not expose a general-purpose shell.
7. Enforce runtime sandboxing, a non-privileged process identity, network restrictions, and confirmation prompts for security-sensitive operations.

A reduced declaration should resemble:

yaml

allowed-tools: read
tools:
  - read

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description uses expansive invocation language across design creation, UI design, posters, and brand visuals without tight scope boundaries. That makes accidental or automatic selection more likely, which is risky because the skill advertises itself as broadly applicable while also declaring capabilities beyond simple Markdown guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description explicitly states '支持中文交互' as part of the skill behavior, and the document consistently presents the skill as Chinese-interaction oriented without indicating user choice or opt-in. This can amount to a language-policy issue because it suggests a fixed language preference rather than offering the user a locale option.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is broad enough to match many ordinary creative or UI-related requests, which raises the likelihood of over-invocation. In a skill with unnecessary exec/write capabilities, broad triggering increases exposure by activating a higher-privilege skill more often than needed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill claims it is a pure Markdown instruction skill that does not require exec capability, yet the manifest grants exec. This mismatch can mislead users and orchestration systems into trusting the skill as non-executing while still enabling command execution, increasing the chance of unnecessary shell access being available during invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill is presented primarily as a frontend/UI design assistant, but it also declares write/export capability without a narrowly scoped justification. Excess file modification capability violates least privilege and could allow unintended file creation or overwriting if the skill is auto-invoked in broad creative contexts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The API Key section states that the skill is Markdown-based and requires no additional API key, because generation is handled by the agent's built-in LLM. Later, the security section warns about API key leakage and recommends environment-variable configuration, which creates an active contradiction about whether this skill expects user-managed keys.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.