Security audit

HTML设计工具

Security checks for vulnerabilities and agentic risk

Overview

This HTML design skill is not clearly malicious, but it asks for broad command and file authority that is not well scoped to its stated design purpose.

Review this skill before installing. It appears to be a broad design-assistant markdown skill rather than malware, but it grants command execution and file mutation authority without concrete limits; install only if you are comfortable supervising its use and restricting what commands it may run.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The skill is presented as an HTML/CSS design tool, but the documented functionality expands into generic API use, command execution, collaboration, image editing, and model tuning without clear scope boundaries. This mismatch increases the chance the agent will be invoked in broader, higher-risk contexts than users or policy expect, weakening least-privilege assumptions and enabling unintended tool use.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Declaring a general exec capability for a design-focused skill materially increases risk because shell access can read files, modify the environment, or execute arbitrary commands unrelated to HTML/CSS generation. Since no narrowly tailored justification or guardrails are defined, the skill could become a pivot point for local command execution if prompted or misrouted.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document claims only allowlisted commands are executed, but the manifest exposes a general exec tool and provides no actual enforcement mechanism. This creates a dangerous trust gap: users and downstream systems may assume command safety controls exist when the skill definition does not implement them, leaving arbitrary execution risk in place.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The skill uses broad, underspecified capability language without clear activation boundaries, which can cause the agent to apply the skill in contexts beyond simple design assistance. In combination with read/write/exec tools, vague scope increases the chance of unsafe invocation and privilege misuse because there is no crisp statement of what the skill must not do.

Static analysis

No suspicious patterns detected.