ClawHub
Back to skill

Security audit

Tailwindcss Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This is a Tailwind CSS helper skill with ordinary setup examples and no evidence of hidden, destructive, or data-stealing behavior.

Review the broad trigger wording before relying on automatic skill selection. If installing, prefer project-local Tailwind dependencies with pinned versions and a committed lockfile, avoid global npm installs, and do not use the CDN script for production or sensitive applications.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:193
Finding

Unpinned npm Dependencies and Global Package Installation

Content
View full analysis
Remediation
View remediation
postcss@ autoprefixer@ ``` 2. Commit and review `package-lock.json`, and use `npm ci` in automated or reproducible environments. 3. Avoid global package installation. Install tools as project-local development dependencies and invoke the locked local binary through package scripts. 4. Configure a trusted npm registry and verify package names, publishers, provenance, and integrity metadata before installation. 5. Audit both direct and transitive dependencies with appropriate software-composition-analysis tooling. 6. Consider disabling lifecycle scripts during initial inspection with `npm ci --ignore-scripts`, then explicitly enable only reviewed scripts where operationally feasible. 7. Run installation and builds in an isolated, least-privileged environment without production credentials. ]]>

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:197
Finding

Mutable Remote JavaScript Loaded from a CDN

Content
View full analysis
``` ### Technical Analysis The documented prototype option loads and executes JavaScript directly from a remote URL. The URL is not pinned to an immutable reviewed version and does not include a Subresource Integrity hash. As a result, the code that executes in the browser can change after the Skill has been reviewed. HTTPS protects transport integrity but does not protect against compromise of the CDN, publishing account, DNS/control plane, or the upstream asset itself. No evidence indicates that the current Tailwind CDN resource is malicious; this is a conditional supply-chain exposure caused by trusting mutable remote code. ### Attack Path 1. An attacker compromises the CDN asset, its publishing pipeline, an authorized account, or related infrastructure. 2. The mutable URL begins returning attacker-controlled JavaScript. 3. A developer follows the documented CDN approach and includes the script in a page. 4. A visitor opens the affected page, causing the browser to retrieve and execute the altered payload. 5. The payload runs in the page's origin context and can interact with DOM content, browser-accessible storage, and same-origin application functions available to that page. ### Impact Assessment A compromised CDN payload could modify rendered content, capture data entered into the page, access non-`HttpOnly` origin storage, make authenticated same-origin requests, or redirect users. The exact scope depends on the hosting application's origin, Content Security Policy, available browser credentials, and surrounding application functionality. This finding does not establish operating-system-level code execution. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

构建适配多端的卡片组件。

html
<!-- 响应式卡片:移动端单列,桌面端三列 -->
<div class="grid grid-cols-1 sm:grid-cols-2 lg:grid-cols-3 gap-4 p-4">
  <div class="bg-white rounded-lg shadow-md p-6 hover:shadow-lg transition-shadow">
    <h3 class="text-lg font-semibold text-gray-900 mb-2">卡片标题</h3>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
placeholder="you@example.com" />
  </div>

  <!-- 错误状态 -->
  <div>
    <label class="block text-sm font-medium text-gray-700 mb-1">密码</label>
    <input type="password"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description and the rest of the skill are written in Chinese, and the file does not state that the user may choose another language or that the skill is intentionally restricted to a Chinese-speaking region. This can violate a language/locale policy when a skill implicitly enforces one language without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest and overview position the skill as a Tailwind CSS utility-class writing and best-practices toolkit. However, the capability sections define generic operational verbs such as create, query, export, modify, reset, import, save, and convert, which are much broader than Tailwind guidance and are not tied to CSS-specific behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The listed coverage keywords include generic terms like CSS, core capabilities, best practices, and personal developer onboarding language rather than a constrained trigger set. As written, this natural-language scope is broad enough to match many ordinary frontend requests beyond this skill's intended boundaries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The '不适用场景' section explicitly excludes 运维部署管理, while the '触发条件' section says the skill should be used when doing 开发部署. These statements directly conflict about whether deployment-related use is in scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation text says to use the skill whenever code generation, programming assistance, debugging/testing, or deployment is needed. Those categories are very broad and not specific to Tailwind CSS, which increases the chance of unintended invocation for many unrelated development tasks.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The capability matrix says performance optimization is not supported in the free version. Later sections provide production build instructions using minification, which is a form of optimization guidance and creates a mismatch between the declared edition scope and the actual documented behavior.

Content

No source excerpt is available for this finding.