Security audit

前端设计工坊

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a frontend design helper, but it declares broad read/write/command access and includes unrelated API, file-processing, environment-management, and data-pipeline scenarios that users should review carefully.

Install only if you intend to use it for frontend design/code generation and are comfortable granting read, write, and command execution authority. Avoid using it for API integration, deployment, environment management, ETL, or batch file processing unless the publisher narrows and documents those behaviors, and do not provide secrets or callback URLs without understanding what data would be sent.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as a frontend design/code generation tool, but later advertises unrelated capabilities such as API integration, batch file processing, environment management, and ETL/data pipelines. This scope expansion can cause an agent to invoke a skill with read/write/exec privileges in contexts far beyond user expectations, increasing the chance of unnecessary file, network, or command actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The documentation says the skill does not cover backend API development or DevOps deployment, yet later sections claim support for API integration and environment/deployment-style workflows. These contradictions can mislead routing and user trust, causing the skill to be used in higher-risk operational contexts despite its supposedly limited design-only purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The invocation description uses very broad triggers such as design creation, UI design, posters, brand visuals, enterprise teams, and automation workflows. Overly broad routing language increases unintended activation of a skill that has exec, read, and write tools, which can lead agents to select it for tasks outside its safest intended domain.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The usage scenarios enumerate broad operational categories including third-party API integration, file batch processing, environment management, information retrieval, and data pipelines. In the context of a skill with exec/write/read access, this materially expands the effective authority surface and can trigger the skill in sensitive or destructive contexts unrelated to frontend design.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill accepts a callback_url and discusses third-party API usage, but it does not clearly warn users that provided content or generated results may be transmitted externally. This creates a data exfiltration and privacy risk, especially if users include sensitive design materials, internal project details, or secrets in prompts or generated artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.