ClawHub
Back to skill

Security audit

ui-ux-toolkit

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it asks for command and file-write authority while giving incomplete and conflicting instructions about what it will run and whether it uses local data or external APIs.

Review this before installing. Treat all command examples as manual steps, do not run sudo or administrator commands through the agent, and do not provide API keys unless the publisher clarifies which external service is actually used. If you use the persistence feature, allow writes only to the expected design-system/ paths and verify changes before committing them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Content
brew install python3
# ...
# Ubuntu/Debian
sudo apt update && sudo apt install python3 python3-pip
# ...
# Windows
winget install Python.Python.3.12
Confidence
87% confidence
Finding
The chained command `sudo apt update && sudo apt install ...` combines multiple privileged actions into a single line, reducing opportunities for review and making accidental or prompt-driven execution more dangerous. In an agent context with exec capability, chained root commands materially increase the risk of unintended system modification and make it harder to inspect failures between steps.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill declares exec capability and provides command-invocation examples without clearly warning that local scripts/commands will be executed. In an agent context, normalizing command execution without prominent safeguards increases the chance of unsafe or unreviewed local execution, especially if later prompts inject user-controlled arguments.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs the agent to persist design-system files into the workspace without a clear upfront warning or explicit user-consent requirement for modifying local files. In agent environments with write capability, this can lead to unintended file creation or overwriting, especially when combined with autonomous execution flows.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
brew install python3
# ...
# Ubuntu/Debian
sudo apt update && sudo apt install python3 python3-pip
# ...
# Windows
winget install Python.Python.3.12
Confidence
89% confidence
Finding
The documentation includes sudo-based installation commands, which normalize privileged execution in a skill that also advertises exec support. In agent-assisted environments, encouraging root-level commands can increase the blast radius of mistakes or prompt-influenced execution, leading to system-wide changes instead of user-scoped ones.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The dependency section explicitly states that the CLI search tool runs on local data, needs no extra API key, and does not depend on external APIs. Later FAQ and troubleshooting sections state that API keys are required and discuss API authentication failures, which directly contradicts the earlier operational description and changes the user's understanding of how the skill actually works.

Natural-Language Policy Violations

Low
Confidence
86% confidence
Finding
The visible display name, summary, and description are entirely in Chinese, and the document does not state that the skill is region-specific or provide any user choice for language. Under the policy, forcing a specific language without opt-in is a natural-language policy issue unless the locale constraint is justified.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The security section discusses HTTPS transport and protecting externally configured API keys, but the earlier description says the tool is based on local CSV data and does not rely on external APIs. This is not merely incomplete documentation; it asserts a different operational model than the one described for the skill.

Static analysis

No suspicious patterns detected.