ClawHub
Back to skill

Security audit

Ui Ux Design Tool Free

Security checks for vulnerabilities and agentic risk

Overview

The skill is mainly a UI/UX guide, but it includes administrator-level installer commands and automatic network diagnostics that should be reviewed before use.

Review this skill before installing. Do not allow an agent to run the Node.js, npm, npx, sudo, ping, firewall, or proxy commands automatically. If you use it, treat setup snippets as manual references, prefer official or pinned installers, and run project initialization in an isolated workspace without unnecessary credentials.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:449
Finding

Unverified Remote Script Executed with Root Privileges

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 449
Vulnerability Type: Remote payload retrieval and privileged execution
Risk Level: Critical

bash
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -

Technical Analysis

The installation instruction downloads a mutable script from an external URL and pipes it directly into a shell running through sudo. The remote response is not pinned to a reviewed version and is not subject to checksum validation, signature verification, or local inspection before execution.

Consequently, the code that will execute can change after the Skill has been reviewed. Compromise of the remote service, its publishing account, the delivery infrastructure, or the relevant TLS trust chain could cause attacker-controlled shell commands to run as root. Privileged remote script execution is also unnecessary for the Skill's primary purpose of providing UI/UX design guidance.

Attack Path

  1. The Agent loads the Skill and follows its Node.js installation instructions.
  2. The Agent invokes the command through the allowed exec capability.
  3. curl retrieves the current response from the external NodeSource URL.
  4. The response is passed directly to sudo -E bash without verification or review.
  5. If the response has been maliciously altered, the attacker's commands execute with root privileges.
  6. The payload can modify system files, access protected data, install additional software, or establish persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution as root on the affected host. The resulting scope can include all local users, protected system files, locally stored credentials, development secrets, installed tools, network configuration, and any resources accessible from the host. An attacker with root access could also disable security controls or establish system-wide persistence.

Remediation
View remediation

Remediation Suggestions

  • Remove the direct curl | sudo bash pipeline.
  • Prefer installation through an operating-system repository that is already configured and trusted.
  • If an external installer is unavoidable, download it to a local file without executing it.
  • Pin the installer or artifact to an explicitly reviewed version.
  • Verify a vendor-published cryptographic signature or checksum before execution.
  • Present the script for inspection and require explicit user approval before privileged execution.
  • Run only the minimum required command with elevated privileges rather than an entire remote script.
  • Do not preserve the caller's environment with sudo -E unless specific required variables have been reviewed and allowlisted.

T08 · Insecure Dependencies

Error
Location
SKILL.md:296
Finding

Mutable npm Packages Downloaded and Executed Without Version Pinning

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 296–303
Vulnerability Type: Unsafe third-party dependency retrieval and execution
Risk Level: High

bash
npx create-next-app@latest my-project --typescript --tailwind --app
cd my-project

npm create vite@latest my-project -- --template react
cd my-project
npm install -D tailwindcss
npx tailwindcss init

Technical Analysis

The instructions use @latest or omit an exact package version. This makes the effective package contents mutable and prevents the installation from being reproducible. The npx and npm create commands can retrieve packages from the configured registry and immediately execute their CLI entry points. Package installation can also execute lifecycle scripts with the privileges of the Agent user.

A later compromised release, registry account takeover, malicious transitive dependency, or registry substitution could therefore introduce code that was not present during this audit. The absence of exact version constraints and a reviewed lockfile increases supply-chain exposure.

Attack Path

  1. The Agent follows the project initialization instructions.
  2. npm resolves @latest or another unpinned package version at execution time.
  3. The selected package and its transitive dependencies are downloaded from the configured registry.
  4. npx, npm create, package CLI code, or installation lifecycle scripts execute locally.
  5. If a resolved package or dependency is compromised, attacker-controlled code runs with the Agent user's privileges.
  6. The malicious code can read or alter project files, user-accessible credentials, npm configuration, SSH material, or other accessible resources.

Impact Assessment

Exploitation can yield arbitrary code execution as the user running the Agent. The attacker could compromise the generated project, tamper with source code and build outputs, steal user-readable development credent ...[truncated 222 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest and unversioned package references with reviewed, exact versions.
  • Generate and commit a lockfile from a trusted environment.
  • Use npm ci for deterministic installation after the project has been initialized.
  • Review package provenance, maintainers, release history, and registry source.
  • Use npm integrity metadata and verify signatures or attestations where available.
  • Disable lifecycle scripts with --ignore-scripts when they are not required.
  • If scripts are required, review them and their transitive dependencies before execution.
  • Run package initialization in a non-privileged, isolated workspace with no unnecessary credentials.
  • Configure an allowlisted registry rather than accepting arbitrary registry substitutions.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:394
Finding

Automatic Network and Security-Configuration Diagnostics Exceed the Skill's Purpose

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 394
Vulnerability Type: Excessive network reconnaissance and configuration inspection
Risk Level: Medium

text
On failure, automatically execute ping to test network connectivity,
inspect firewall and proxy settings, reconnect, and retry the command,
up to three times.

Technical Analysis

The Skill directs the Agent to perform automatic network probing and inspect firewall and proxy settings whenever an operation fails. This behavior is unrelated to the Skill's declared UI/UX design purpose and is not restricted to a specific destination, diagnostic command, or minimum set of configuration data.

The instruction does not require explicit user authorization before expanding from a failed design or package-management operation into network and security-configuration inspection. Depending on how an Agent implements the broad instruction, it may expose proxy endpoints, internal network details, or firewall configuration in command output and logs.

No concrete command for firewall or proxy inspection is defined, so the precise privileges obtained depend on the Agent's interpretation and the host's existing access controls. The issue is nevertheless a least-privilege violation in the Skill instructions.

Attack Path

  1. A command initiated under the Skill fails, including failure caused by an invalid input or unavailable package.
  2. The error-handling instruction automatically activates network diagnostics.
  3. The Agent sends connectivity probes and queries locally accessible firewall or proxy configuration.
  4. Diagnostic output is returned to the Agent context or retained in logs.
  5. Internal addressing, proxy configuration, or security-control details may become available for subsequent reconnaissance.
  6. The failed command is retried as many as three times, potentially repeating unnecessary network activity.

Impact Assessment

The lik ...[truncated 420 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove automatic network, firewall, and proxy inspection from generic error handling.
  • Return the original error to the user before initiating any diagnostics.
  • Require explicit user approval for each diagnostic action.
  • Restrict connectivity tests to a clearly identified host required by the failed operation.
  • Avoid enumerating firewall or proxy configuration unless it is directly necessary and separately authorized.
  • Redact credentials, proxy authentication data, internal addresses, and sensitive configuration values from output.
  • Do not retry commands automatically when doing so could repeat network or installation side effects.
  • Document exact diagnostic commands and execute them with ordinary user privileges in a constrained environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The curl ... | sudo -E bash - chain is a classic command-chaining abuse pattern: it downloads data from the network and immediately executes it as root. In the context of a UI/UX design skill, this behavior is unrelated to the stated purpose and substantially increases the danger because users would not expect privileged shell execution from design guidance content.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md
brew install node

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install nodejs

# Windows

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are broad enough to activate for many generic design or creative requests, increasing the likelihood that an agent loads a skill with exec capability in contexts where it is unnecessary. Over-broad activation widens exposure to the command-execution behavior embedded elsewhere in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes exec-based initialization commands that fetch packages and modify the local project, but it does not clearly warn the user that these actions require network access and may execute third-party code. In an agent environment, that omission can cause unintended command execution with filesystem and network side effects.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The skill instructs use of npx create-next-app@latest, which pulls and executes the latest remote package version at runtime. In an agent context with exec enabled, unpinned remote execution increases supply-chain risk and can lead to unexpected or malicious code execution if the upstream package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The command npx tailwindcss init may download and execute a package version from the network if not already present, without version pinning or integrity control. In a skill that advertises exec support, this creates avoidable supply-chain exposure and non-deterministic behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

A UI/UX design guide should not autonomously introduce network troubleshooting commands like ping, firewall/proxy checks, and automatic retries. This expands the skill beyond its stated purpose into system/network operations, increasing the chance an agent performs unnecessary reconnaissance or shell activity on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The error-handling section recommends automatically running ping and retrying commands up to three times without clear consent. Automatic network probing and repeated execution are unnecessary for a design skill and can leak environment information or create unapproved system activity.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

sudo -E preserves environment variables while running a remote script as root, which can amplify risk if attacker-controlled or unsafe environment values influence execution. Combined with curl | bash, this creates a particularly dangerous privileged execution chain.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md
brew install node

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install nodejs

# Windows

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
95% confidence
Finding

sudo -E preserves environment variables while running a remote script as root, which can amplify risk if attacker-controlled or unsafe environment values influence execution. Combined with curl | bash, this creates a particularly dangerous privileged execution chain.

Content

Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.

md
brew install node

# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install nodejs

# Windows

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
71% confidence
Finding

sudo apt install nodejs is a privileged package-management command. While common in documentation, embedding root-required commands in a broadly triggered, exec-enabled skill increases the chance an agent may attempt system-wide changes without adequate consent.

Content

Scanner excerpt · SKILL.md (reported line 450)May include surrounding context.

md
# Ubuntu/Debian
curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
sudo apt install nodejs

# Windows
winget install OpenJS.NodeJS.LTS

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The API key section says the skill is based on Markdown guidance and that Tailwind CSS does not rely on external APIs, suggesting a largely local, documentation-driven tool. But other parts of the file include network-sensitive install commands and automatic ping-based connectivity checks, which conflicts with the implied purely local/non-network operational model.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.