Ux Design Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.1

Overview

This UX guidance skill appears non-malicious, but it asks for command and file-write authority that does not fit its Markdown-only design-advice purpose.

Install only with host controls that deny exec and write for this skill, or request a revised version that removes those tools, removes ping/network diagnostics, and clearly scopes any export or callback behavior. No evidence of theft, persistence, or destructive intent was found.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:50

Finding

Excessive Command Execution and File-Write Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 50–54
Vulnerability Type: Violation of least privilege
Risk Level: Medium

Complete Code Snippet

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill declares access to command execution and file-writing tools even though its documented purpose is to provide UX design guidance through natural-language analysis. The same file describes the Skill as a pure Markdown capability that does not require command-line tools.

The exec permission can allow commands to run with the privileges of the hosting Agent process. The write permission can permit modification or creation of files accessible to that process. Neither capability is necessary for generating UX recommendations, checklists, or structured responses.

Merely declaring these tools does not prove that malicious commands will be executed. However, exposing unnecessary privileged tools increases the impact of prompt injection or adversarial content supplied as UX analysis input.

Attack Path

1. The Agent loads the Skill with exec and write tools enabled.
2. An attacker supplies adversarial content in the UX analysis input, such as text embedded in a design specification or project file.
3. The content attempts to persuade the Agent to run a command or write a file as part of the requested analysis.
4. Because the Skill has declared these unnecessary tools, an Agent that fails to reject the injected instruction may invoke them.
5. Commands or file operations execute with the permissions available to the Agent process.

This exploitation path is conditional on the hosting Agent granting the declared tools and failing to isolate untrusted input from Skill instructions.

Impact Assessment

Successful exploitation could allow command execution or file modification within the security context of the Agent process. The accessible scope could include proje ...[truncated 329 chars]

Remediation

View remediation

Remediation Suggestions

• Remove exec and write from the declared tool list.
• Retain read only if the Skill must inspect user-supplied design documents; otherwise, declare no tools.
• Enforce tool permissions at the host level rather than relying only on Skill metadata.
• Require explicit user approval for any future command execution or filesystem modification.
• Treat analyzed specifications, HTML, and project documents as untrusted data rather than executable instructions.
• Add a rule stating that content encountered in analyzed files must never authorize tool calls.
• If future functionality genuinely requires writes, restrict them to a dedicated output directory and prevent overwriting existing files.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:404

Finding

Unnecessary Network Diagnostic Command in Missing-Input Error Handling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 404
Vulnerability Type: Unsafe and unrelated command-execution instruction
Risk Level: Low

Complete Code Snippet

The source error-handling entry states, translated into English:

text

| 1 | Missing input parameter | The user did not provide a required parameter | Ask the user to provide the required parameter, then execute a ping command to test network connectivity, inspect firewall and proxy settings, reconnect, and execute the command again | P0 |

Technical Analysis

Missing UX analysis input is a validation error and has no necessary relationship to network connectivity, firewall configuration, or proxy settings. Directing the Agent to run ping and inspect network configuration unnecessarily crosses the boundary from Markdown-based UX guidance into host-environment diagnostics.

This instruction also conflicts with the Skill's later statement that it is a pure Markdown Skill requiring no command-line execution. No hostname, argument construction, or user-controlled command interpolation is specified, so the evidence does not establish command injection. The confirmed issue is the unnecessary invocation of system and network diagnostics.

Attack Path

1. The Skill is loaded by an Agent that permits the declared exec tool.
2. A request omits a required input parameter.
3. The documented error-handling branch is selected.
4. The Agent follows the instruction to execute ping and inspect firewall or proxy settings.
5. The Agent performs host or network reconnaissance unrelated to the UX task.

The behavior depends on the Agent interpreting the documentation as an operational instruction and granting command-execution access.

Impact Assessment

The instruction may expose network reachability, proxy configuration, firewall behavior, or related environmental characteristics in command output or execution logs. It may also trig ...[truncated 310 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the error workflow with a simple validation response identifying the missing parameter.
• Do not run ping or inspect firewall and proxy settings in response to missing UX input.
• Separate input-validation failures from genuine transport or API connectivity failures.
• If network diagnostics are ever required, request explicit user approval and require a user-provided, validated destination.
• Avoid constructing shell commands from user-controlled hostnames or other input.
• Remove the exec tool declaration so this instruction cannot result in command execution.
• Update the error table to use a response such as: “Identify the missing required parameter and ask the user to provide it before continuing.”

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims to be Markdown-only and not to require command execution, yet its error-handling instructions tell the agent to run ping for network diagnostics. Even a seemingly harmless command normalizes shell execution in a context where it is unjustified and could be replaced or expanded into more dangerous command behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation explicitly claims the skill requires no command-line execution while simultaneously enabling exec in the manifest. This contradiction can mislead users and reviewers into trusting a skill with far more privilege than its description suggests, making abuse of execution capability harder to detect.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

文件标题、描述、示例、FAQ 和输出说明均固定为中文，没有提供用户语言偏好选项，也没有说明该技能仅面向特定中文场景。根据语言/区域政策，强制单一语言而无用户选择属于自然语言策略问题。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill presents itself as a Markdown-only UX guidance tool, yet its manifest grants exec and write capabilities that are unnecessary for the advertised functionality. This mismatch increases attack surface and creates an opportunity for unexpected command execution or filesystem modification if the skill is invoked or extended unsafely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill documents export, callback URLs, and privileged tools like exec/write without warning users about possible data writes or external transmission. In a tool that may process user-provided content, undisclosed output or callback behavior can lead to unintended data exposure or unauthorized persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

L252-L254 的“触发条件”章节没有提供明确的触发短语、范围约束或排除条件，且正文内容残缺，无法判断技能应在什么具体请求下触发。这种模糊描述容易与一般性的设计求助语句重叠，增加误触发风险。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Network diagnostic behavior is unrelated to a UX design principles skill and therefore represents suspicious scope expansion. Unnecessary networking or shell-based diagnostics can leak environmental information and condition users to accept unrelated privileged actions from a low-risk-seeming tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.