ClawHub
Back to skill

Security audit

前端设计-专业版

Security checks across malware telemetry and agentic risk

Overview

This skill is a frontend design and component-generation guide whose file, command, and network notes are mostly disclosed and aligned with that purpose.

Before installing, treat this as a code-generation helper: use it in a controlled project workspace, review generated files before committing, avoid placing license keys in source files, and confirm any npm, npx, Python, or network troubleshooting commands before running them.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The skill is for frontend design, yet it documents generic network diagnostics and HTTPS/network troubleshooting behavior that is outside the minimally necessary scope. Extra operational guidance like ping/connectivity checks can normalize unnecessary network actions by an agent, expanding attack surface and enabling unexpected outbound activity in environments where the skill should remain local and design-focused.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill describes generating components and writing output into local project directories without clearly warning that files will be created or modified. In an agent context with write/exec tools enabled, this can lead to unintended filesystem changes, overwriting source files, or silently introducing generated artifacts into a repository.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.