前端设计-专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:46 AM UTC
• Version: 1.0.0

Overview

This frontend design skill is mostly purpose-aligned, but it gives under-scoped execution, package-installation, API-credential, and administrator-permission guidance that should be reviewed before use.

Install only in a project you can safely modify. Review any generated paths before allowing writes, avoid running npm/npx or generation commands as administrator/root, pin frontend tool versions through a lockfile, and do not provide API keys or license credentials unless you know exactly which service receives them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:258

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 258-259
Vulnerability Type: Unpinned and insufficiently verified third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet

markdown

| Storybook | Component documentation | Recommended | npx storybook init |
| Style Dictionary | Token management | Recommended | npm install style-dictionary |

The executable commands from the original snippet are:

bash

npx storybook init
npm install style-dictionary

Technical Analysis

The documentation recommends retrieving npm dependencies without specifying reviewed versions or requiring integrity verification. In particular, npx storybook init can resolve a package from the configured npm registry, download it, and immediately execute its command-line entry point.

Because no version is pinned, the effective code executed by users can change after this skill has been reviewed. The instructions also do not require a committed lockfile, registry allowlist, checksum validation, provenance verification, or disabled installation scripts.

Although no malicious package is included in the audited project and no current compromise of either named dependency was established, this installation pattern creates a supply-chain exposure. A compromised package release, registry account, dependency chain, DNS or registry configuration, or local npm configuration could cause arbitrary package code to run.

Attack Path

1. A user follows the dependency setup instructions in SKILL.md.
2. npx or npm contacts the configured package registry.
3. The package manager resolves a mutable, unpinned package version and its transitive dependencies.
4. Package CLI code or applicable installation lifecycle scripts execute locally.
5. If any resolved component is malicious or compromised, it executes with the permissions of the user running the command.
6. The malicious component could access pr ...[truncated 761 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct tool to a specifically reviewed version, for example by invoking npx --no-install against a dependency already declared in the project.
2. Declare dependencies in package.json and commit a reviewed lockfile such as package-lock.json.
3. Use npm ci for reproducible installation rather than resolving new versions during each invocation.
4. Configure an approved registry and reject unexpected package sources.
5. Review transitive dependencies and package provenance before upgrading.
6. Use package integrity data from the lockfile and enable available signature or provenance verification.
7. Disable lifecycle scripts with --ignore-scripts where they are not required. If scripts are required, document and review them explicitly.
8. Run package installation and generation in an isolated, nonprivileged environment with restricted credentials and network access.
9. Add an explicit warning that npm and npx commands must never be run as an administrator or root user.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:399

Finding

Recommendation to Run Failed Operations with Administrator Privileges

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 399; duplicated at line 422
Vulnerability Type: Violation of least privilege through unnecessary administrator execution
Risk Level: Medium

Vulnerable Code Snippet

The following is an English translation of the duplicated troubleshooting entry:

markdown

| Insufficient permissions | The current user lacks read/write permission | Check file permissions and run as administrator |

The security-sensitive instruction is:

text

Run as administrator

Technical Analysis

The troubleshooting guidance treats administrator execution as a general solution for file permission failures. Frontend design-system and component-generation operations should normally run under an ordinary user account and write only to project-controlled directories.

Elevation does not correct the underlying ownership, access-control, or path-selection problem. Instead, it grants the invoked command and all loaded dependencies broader access than the documented task legitimately requires. This is especially risky because the same skill recommends downloading and executing npm packages without pinned versions.

The guidance does not define which command should be elevated, constrain the elevated operation, require verification of the executable, or direct users to drop privileges afterward. It therefore creates a path by which ordinary package or command execution may receive administrative permissions unnecessarily.

Attack Path

1. A generation, installation, or file-writing command fails because the selected path is not writable.
2. The user follows the troubleshooting table and reruns the operation as an administrator.
3. The elevated operation invokes a local tool, downloaded package, package lifecycle script, or generation process.
4. Any compromised dependency or unsafe operation now executes with administrator permissions.
5. The process can modify res ...[truncated 1023 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both recommendations to run as an administrator.
2. Instruct users to verify that the output path is inside a project directory owned by their ordinary account.
3. Diagnose the actual cause by checking path ownership, filesystem permissions, read-only mounts, access-control lists, and parent-directory permissions.
4. Correct ownership or permissions only for the minimum necessary project path; do not apply recursive or system-wide permission changes.
5. Direct generated files, caches, and temporary data to user-scoped writable directories.
6. Explicitly prohibit running package managers, package lifecycle scripts, build tools, or generated scripts as administrator or root.
7. Recommend a disposable container or sandbox if a tool cannot operate with ordinary permissions.
8. Fail safely and request manual review when access to a genuinely privileged path is required rather than suggesting generic elevation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The primary description frames this as a frontend design tool with bounded use cases. Later sections introduce generic API connection/setup flows and API-key-dependent interface calls, which contradict the narrowly described design-focused behavior and make the skill appear to do more than the stated documentation initially allows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The description says "Use when 需要设计创作、UI设计、海报制作、品牌视觉时使用," which covers very broad everyday creative requests rather than a narrowly scoped trigger. Without explicit constraints or negative examples beyond excluding 3D/animation, this could cause the skill to match many generic user requests unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description states "支持中文交互，无需复杂配置即开即用," presenting Chinese interaction as the default behavior without indicating that users may choose another language. This can violate language/locale policy when the skill forces or strongly prescribes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes commands that generate files and use execution tooling without a prominent warning that local files may be created or modified. This increases the risk that users or agents run state-changing operations without informed consent, which is especially concerning in an exec/write capable skill because outputs target project directories like ./src/components/ and ./design-system/.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The skill recommends invoking Storybook via npx storybook without pinning an exact package/version. This can fetch and execute whatever version is current in the registry or resolution path at runtime, creating a supply-chain risk and reducing reproducibility. In a skill that also advertises exec capability, this is more dangerous because users may run the command directly in their local environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The '轻松上手' section instructs users to configure API keys, initialize connections, and call APIs, while the rest of the document mostly describes local design-system generation, component generation, and analysis workflows. This is an active documentation inconsistency because the onboarding steps imply a different operational model than the documented skill behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.