极简设计系统

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:57 AM UTC
• Version: 1.0.1

Overview

This is a frontend design-system guidance skill with no hidden execution, persistence, credential handling, or unrelated data access.

Before installing, treat this as a Chinese-language frontend design assistant. Review any generated code changes normally, and if you follow its dependency suggestions, prefer pinned package versions, lockfiles, and an isolated development environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:228

Finding

Unpinned Third-Party npm Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 228–229
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

| Tailwind CSS | 工具 | 推荐 | npm install tailwindcss |
| Framer Motion | 库 | 可选 | npm install framer-motion |

Technical Analysis

The documented npm commands do not specify exact dependency versions, a lockfile, or package integrity values. Consequently, they resolve mutable package versions from the configured npm registry at installation time. The installed code may therefore differ from the version originally reviewed or intended by the skill author.

npm packages and their transitive dependencies can define lifecycle scripts that run during installation. If a named package, transitive dependency, maintainer account, or configured registry is compromised, following these instructions could execute attacker-controlled code. The finding concerns unsafe dependency installation guidance; the audit found no evidence that either named package is currently malicious.

Attack Path

1. An attacker compromises a listed package, one of its transitive dependencies, a package maintainer account, or the registry used by the environment.
2. The attacker publishes a malicious release or alters package resolution so that a malicious artifact is returned.
3. A user or agent follows SKILL.md and runs an unpinned npm install command.
4. npm resolves the attacker-controlled version because no reviewed exact version or integrity-controlled lockfile is required.
5. Malicious code executes through an installation lifecycle script or when the dependency is subsequently imported and used.

Impact Assessment

Exploited installation scripts execute with the privileges of the user or agent running npm. Depending on those privileges and the host environment, an attacker could access project files, source code, environment variables, locally ava ...[truncated 405 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable installation commands with reviewed, exact versions, for example:

   bash

   npm install --save-exact tailwindcss@<reviewed-version>
   npm install --save-exact framer-motion@<reviewed-version>
   

2. Commit package-lock.json and require reproducible installation with npm ci.
3. Review lockfile changes whenever dependencies are upgraded and avoid uncontrolled automated version changes.
4. Use a trusted registry and enforce approved package names and scopes to reduce dependency-confusion risk.
5. Verify package provenance, publisher identity, release history, and integrity before approving upgrades.
6. Run dependency vulnerability and malware scanning in CI.
7. Disable lifecycle scripts with --ignore-scripts where package functionality permits; otherwise, explicitly review all required lifecycle scripts.
8. Perform dependency installation in a least-privileged, isolated build environment without unnecessary credentials or access to sensitive host resources.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown/manifest content presents the skill name, summary, and description only in Chinese, and the rest of the file continues in that language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.