Security audit

Front End Dev

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent frontend design/scaffolding skill with ordinary npm setup risk, but no evidence of hidden persistence, data theft, or destructive behavior.

Install only if you are comfortable running npm-based scaffolding scripts. For stricter environments, pin package and CLI versions, review generated lockfiles, and run the init/bundle scripts in a clean project directory or sandbox without unrelated secrets.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: scripts/init-vite.sh:19
Finding: Unpinned npm Dependencies and Mutable “Latest” CLI Packages Permit Supply-Chain Code Execution
Content: View full analysis
.nvmrc echo "📦 Installing dependencies..." # Install Tailwind CSS npm install -D tailwindcss postcss autoprefixer npx tailwindcss init -p # Install animation library npm install framer-motion # Install shadcn/ui base dependencies npm install tailwindcss-animate class-variance-authority clsx tailwind-merge npm install lucide-react npm install @radix-ui/react-slot ``` #### `scripts/init-vite.sh:333-335` ```bash npx shadcn@latest add button badge card accordion dialog navigation-menu tabs sheet separator avatar alert -y || { echo "⚠️ Warning: Some shadcn components may not have installed. Run 'npx shadcn@latest add [name]' manually." } ``` #### `scripts/init-nextjs.sh:19-25` ```bash npx create-next-app@latest "$PROJECT_NAME" \ --typescript \ --tailwind \ --eslint \ --app \ --src-dir \ --import-alias "@/*" ``` #### `scripts/init-nextjs.sh:35-48` ```bash # Install animation library npm install framer-motion # Install shadcn/ui echo "📦 Initializing shadcn/ui..." npx shadcn@latest init -y -d # Install common components echo "📦 Installing common components..." npx shadcn@latest add button badge card accordion dialog navigation-menu tabs sheet separator avatar alert -y || { echo "⚠️ Warning: Some shadcn components may not have installed. Run 'npx shadcn@latest add [name]' manually." } # Install lucide icons npm install lucide-react ``` #### `scripts/bundle-artifact.sh:23-45` ```bash if ! npm ls p ...[truncated 3482 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description presents a high-level site-generation skill that can create distinctive static web UIs from plain text requirements across both Vite and Next.js workflows. The supplied code instead performs project bootstrapping for a Next.js app only: it checks Node, runs create-next-app, installs framer-motion/lucide/shadcn components, and writes a basic config, CSS animations, and starter page. This is materially narrower and different in primary purpose from an autonomous design/site generator. There is no evidence of parsing user requirements, generating varied layouts, supporting Vite, or producing notably distinctive designs beyond a simple template.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The code is an environment/project initializer for a Vite-based React frontend stack. It installs dependencies, writes config/CSS/util/component files, and adds common shadcn components. That is related to the declared tech stack, but the declared description overstates the behavior significantly. There is no logic to interpret plain-text requirements, synthesize a complete static site, enforce anti-AI-slop aesthetics, or generate production-ready page designs. It also does not include any Next.js setup despite claiming support for both Vite and Next.js. No malicious or unrelated capabilities are evident, but the primary purpose is scaffolding a Vite starter template rather than generating distinctive static sites from user requirements.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims a broad site-generation skill that creates production-grade static sites with specific frameworks and aesthetic behavior. The actual code chunk is a single configuration file exporting hardcoded content for a sample marketing site. It contains no code for generating pages, rendering React components, applying Tailwind/shadcn, bundling files, processing plain-text requirements, or handling Vite/Next.js workflows. This is a material mismatch in primary purpose and capabilities, not merely an implementation detail.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 3)May include surrounding context.
md
# Frontend Design Ultimate 🎨 Create distinctive, production-grade static sites with React, Tailwind CSS, and shadcn/ui — no mockups needed. [![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](LICENSE) [![ClawHub](https://img.shields.io/badge/ClawHub-frontend--design--ultimate-purple)](https://clawhub.ai/skills/frontend-design-ultimate)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This is the same underlying issue duplicated by static analysis: invoking unpinned npx shadcn allows execution of whatever version is currently served by the registry. In a skill that users may follow verbatim, that materially increases exposure to supply-chain compromise and non-reproducible builds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 82% confidence
Finding: Using npx parcel without pinning an exact package version allows the executed build tool to vary over time and, in some npx resolution paths, may fetch and run an unexpected version. In a build script that users execute locally, this creates supply-chain risk: a compromised or malicious upstream release could execute arbitrary code during bundling.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Using npx html-inline without an exact pinned version introduces the same supply-chain execution risk for the HTML inlining step. Because this script is intended to be run by developers on their machines, an unexpected or compromised package version could run arbitrary commands with the user's privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The script executes scaffolding code via npx create-next-app@latest, which always pulls the newest package version at runtime rather than a reviewed, fixed version. If the upstream package is compromised or a breaking/malicious release is published, anyone running the initializer will execute attacker-controlled code on their workstation during project setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: npx shadcn@latest init -y -d fetches and runs the latest CLI code at execution time, creating a supply-chain risk. A compromised or malicious release could run arbitrary commands, alter generated files, or implant backdoors into the created project and the developer environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The command npx shadcn@latest add ... dynamically executes whatever code is currently published as the latest shadcn CLI. Because this skill is an initializer intended for developers to run locally, exploitation could directly affect source files, credentials accessible to the shell, or CI environments that automate project bootstrap.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: npx shadcn@latest add ... downloads and executes the latest CLI version at runtime, so the script's behavior can change over time and a compromised or malicious upstream release would be executed on the developer's machine. Because this is an initialization script intended for broad reuse, it increases exposure to supply-chain compromise and hurts reproducibility.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.