Security audit

Ui Design Toolkit Free

Security checks for vulnerabilities and agentic risk

Overview

This looks like a UI design guidance skill, but it needs Review because it grants command execution and vague state-changing capabilities without clear limits or consent.

Review before installing. Use this skill only where command execution is explicitly approved and limited to the current UI project. Treat reset, import, export, save, and convert requests as requiring a preview or confirmation. I found no bundled malware, exfiltration instructions, credential handling, or persistence behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is presented as a UI design guidance toolkit, but it also claims operational abilities such as create/query/export, modify/reset/import, and save/convert without defining strict scope, targets, or safety boundaries. This capability inflation can cause an agent to treat the skill as authorized to perform state-changing actions on user files or project artifacts, increasing the risk of unintended modification or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises import, modify, reset, export, save, and convert operations without warning that these may alter or overwrite user data. When an agent interprets these verbs literally, users may experience unintended file changes or loss of work because no confirmation or rollback expectations are defined.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger conditions are broad enough to match many ordinary design-related requests, increasing the chance that the skill auto-activates outside its narrow intended use. In combination with exec permission and ambiguous operational verbs, over-triggering makes accidental tool use and unintended side effects more likely.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The documentation states that no external cloud services are required, yet the error-handling section instructs network troubleshooting such as ping tests, implying possible network-dependent behavior. This inconsistency can mislead users and agents about the skill's trust boundary and may cause unexpected outbound network activity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill declares exec-enabled behavior even though its documented purpose is UI design guidance, which does not inherently require shell access. Unnecessary command-execution privileges expand the attack surface and could let the agent run local commands based on ambiguous natural-language instructions or future prompt injection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill exposes exec-capable functionality without warning users that local commands may affect the filesystem, environment, or other system state. Even absent explicit malicious payloads, this omission weakens user consent and increases the chance of unsafe command execution under normal agent operation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The natural-language description and operating instructions are presented entirely in Chinese, but the skill does not indicate that Chinese is optional, user-selectable, or required for a specific regional use case. This can constitute a language policy issue when a skill implicitly forces one language without opt-in.
Content: No source excerpt is available for this finding.