Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
L003 的描述全文使用中文且未说明是否支持用户选择其他语言或 locale。按规则，若技能对输出语言存在固定约束但未提供用户选择或明确的正当化说明，可视为自然语言层面的语言策略问题。
- Content
Security audit
Frontend Design V3 Free
Security checks for vulnerabilities and agentic risk
Overview
This is a front-end design guidance skill with no hidden payload or persistence, though its command access is broader than the documented examples require.
Review the broad trigger and the allowed exec permission before installing. For normal use, treat it as a design-style guide for front-end generation, and only allow command execution when you intentionally want the agent to run local checks such as previewing or troubleshooting generated pages.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger condition is overly broad: phrases like design creation, UI design, posters, and brand visuals are common and can match routine user requests unintentionally. In an agent environment, this can cause the skill to activate when not needed, steering outputs unexpectedly and increasing the chance that HTML/CSS/JS generation or exec-enabled behavior is invoked in the wrong context.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation establishes a hard prohibition on repeatedly converging on the same font, specifically calling out Space Grotesk as an example of what should not be used. However, the sample HTML at L099 and L111 and the font-pairing example at L329 directly include Space Grotesk, which contradicts the stated anti-pattern guidance rather than merely omitting nuance.
- Content