Security audit

UI组件生成(免费版)

Security checks for vulnerabilities and agentic risk

Overview

This UI component skill is mostly a local HTML/CSS generator, but it asks for command execution and file-writing authority while describing broad triggers and vague operations beyond component generation.

Review this skill before installing. It appears intended to generate local HTML/CSS components and does not include bundled executable code, but it should be narrowed to UI-component tasks and should explain or remove command execution and file-writing permissions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a narrowly scoped HTML/CSS component generator, but these sections expand it into generic create/query/modify/delete/import/export/save/convert workflows. That scope inflation can cause an agent to apply the skill to unrelated tasks and operate on user data or files beyond the intended UI-generation boundary, increasing the chance of unsafe execution paths.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The manifest grants exec capability even though the described function is just generating local HTML/CSS. Unnecessary command execution materially increases risk because a broadly triggered skill could run shell commands, touch the filesystem, or invoke external programs despite no legitimate need for that privilege.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The file claims the skill is fully local and requires no external API, yet other sections mention network dependence and troubleshooting connectivity with ping. These contradictory statements can mislead users and orchestrators about the trust boundary, causing them to approve or route the skill under a lower-risk assumption than its behavior suggests.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger conditions include broad categories like code generation, programming assistance, debugging, testing, and deployment, which go far beyond UI component generation. Overbroad activation increases the likelihood that the skill is selected in unrelated contexts, where its write/exec permissions become much more dangerous.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill exposes `exec` and `write` capabilities but does not clearly warn users that it may execute commands or modify files. Missing disclosure undermines informed consent and makes privilege misuse more likely, especially when combined with broad triggers and ambiguous operational scope.

Static analysis

No suspicious patterns detected.