Security audit

Ui Ux Promax Tool Free

Security checks across malware telemetry and agentic risk

Overview

This UI/UX guidance skill is not clearly malicious, but it asks for broad write and command-execution capability that is not well scoped to its design-advice purpose.

Review before installing. The skill appears aimed at UI/UX advice and local design-token generation, but it should ideally run as read-only or text-output-only unless you explicitly ask it to save files or run a diagnostic command. Avoid granting command execution or broad write access unless you are comfortable supervising those actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a simple UI/UX guidance tool, but its manifest and documentation expand scope to include write/exec permissions and generic CRUD-style operations. That mismatch increases the attack surface and creates capability confusion, making it easier for the skill to perform actions beyond user expectations under the guise of benign design assistance.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: `exec` is not justified by the stated purpose of providing conversational UI/UX recommendations and generating local design tokens. An unnecessary command-execution capability can be abused to run arbitrary shell commands, inspect the environment, or chain with other permissions for local impact.

Intent-Code Divergence

Medium

Confidence: 85% confidence
Finding: The documentation claims no extra scripts are needed and implies a purely conversational flow, but later sections describe exec-based and command-line-dependent usage. This inconsistency can mislead users and reviewers about the skill's operational behavior, reducing informed consent around risky capabilities.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The trigger conditions are broad enough to activate on many common design-related prompts, increasing the chance the skill is invoked unexpectedly. In combination with write/exec permissions, overly broad activation raises the risk of capability overreach and accidental execution in contexts where users expected simple advice only.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill advertises write/exec and save/export behaviors without clear warnings about filesystem or command side effects. Users may authorize or invoke the skill expecting harmless design suggestions, while the toolset permits state-changing actions that should require explicit disclosure and consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.