ClawHub
Back to skill

Security audit

Picasso

Security checks for vulnerabilities and agentic risk

Overview

This is a broad frontend design guidance skill with some caveats around third-party tool recommendations, but I found no hidden execution, persistence, exfiltration, or destructive behavior.

This skill is reasonable to install for frontend design help. Before following its tool recommendations, avoid running unpinned npx or remote component install commands in sensitive projects; pin versions, inspect generated files, and avoid IP-based location defaults unless the app clearly discloses and needs them.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/tools-catalog.md:43
Finding

Unpinned Package Runner Retrieves Component Code from a Mutable Third-Party Source

Content
View full analysis

Vulnerability Details

File Location: references/tools-catalog.md:43
Vulnerability Type: Supply-chain risk through an unpinned executable package and mutable remote component source
Risk Level: Medium

Complete Code Snippet:

md
### Hit Area Utilities (bazza.dev)
Tailwind classes expanding clickable areas without affecting visual layout.
Install: `npx shadcn@latest add https://bazza.dev/r/hit-area`
Classes: `hit-area-6`, `hit-area-x-4`, `hit-area-l-8`, `hit-area-debug`

Technical Analysis

The recommended command combines two mutable supply-chain inputs:

  1. npx shadcn@latest downloads and runs whichever package release currently owns the latest npm distribution tag.
  2. https://bazza.dev/r/hit-area supplies component content from a third-party URL without a pinned revision or integrity digest.

Consequently, the code executed or installed when a user follows this guidance may differ from the content that was available when the Skill was audited. An attacker who compromises the npm package, maintainer account, package distribution tag, remote domain, hosting infrastructure, or registry response could cause the command to execute or install attacker-controlled code.

The Skill's declared purpose is frontend design and UI engineering guidance. Automatically running a mutable package installer and importing unverified remote code is not necessary to provide that functionality and therefore exceeds the minimum privileges required.

Attack Path

  1. An attacker compromises the npm package, its publishing credentials, the latest distribution tag, the bazza.dev domain, or the remote component registry.
  2. The attacker publishes a malicious package release or replaces the remote hit-area component response with malicious content.
  3. A user or agent follows the Skill's installation recommendation.
  4. npx downloads and executes the currently tagged package rather than a previously aud ...[truncated 1184 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an explicitly audited package version, such as shadcn@x.y.z.
  2. Pin the component source to an immutable commit or versioned registry artifact rather than a mutable URL.
  3. Verify downloaded content using a published cryptographic checksum or signature.
  4. Prefer vendoring the reviewed component source directly in the Skill documentation so users can inspect it before adding it to a project.
  5. Instruct users to retrieve and review generated files before running builds, tests, or application code.
  6. Use lockfiles and reproducible installation mechanisms in downstream projects.
  7. Run third-party installers in a restricted environment without production credentials, sensitive environment variables, or unnecessary filesystem access.
  8. Document the exact expected files and changes so unexpected installer behavior can be detected.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
Findings (13)

Vague Triggers

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill’s trigger criteria are extremely broad and instruct the agent to use this skill for almost any request involving visual output, frontend work, UI/UX, or even incidental design improvement. In an agentic system, this can cause frequent unintended activation, override more specialized skills, and expand the attack surface by injecting a large, prescriptive prompt into unrelated tasks.

Content

No source excerpt is available for this finding.

Unvalidated Output Injection

High
Category
Output Handling
Confidence
65% confidence
Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/performance-optimization.md (reported line 570)May include surrounding context.

md
// layout.tsx
<head>
  <script
    dangerouslySetInnerHTML={{
      __html: `
        (function() {
          var theme = localStorage.getItem('theme') || 'system';

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/ux-writing.md (reported line 244)May include surrounding context.

Every icon-only button needs an aria-label.

html
<!-- BAD -->
<button><TrashIcon /></button>

<!-- GOOD -->

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/loading-and-states.md (reported line 178)May include surrounding context.

}

text

UI: after max retries, show error state with manual retry button. Don't auto-retry forever.

---

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document explicitly recommends pre-filling a user's country from their IP as a UX default. IP-based geolocation is privacy-sensitive, often regulated, and can normalize collecting location-derived personal data without clear notice or consent, which may lead downstream implementations to violate privacy expectations or legal requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Line L099 states 'Helvetica Neue → use Inter (only acceptable here) or Geist,' which imposes a fixed typography preference in natural language. This is a policy-style constraint on language/locale-adjacent presentation choices without any user or project choice mechanism or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The example scaffold sets <html lang="en">, which imposes a specific language/locale in natural-language-facing markup. The document does not offer any user opt-in or explain why English is required, so it conflicts with the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The examples use fixed locales such as 'en-US', 'de-DE', and 'ja-JP' directly in Intl.NumberFormat calls. Because SQP-3 applies to natural-language policy around language/locale handling, this can be read as prescribing specific locales rather than emphasizing user- or system-selected locale preference.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This markdown file includes a retry example that performs an HTTP fetch, which transmits data to a remote endpoint, but the surrounding documentation does not mention any privacy or network disclosure for that behavior. Under the markdown-specific SQP-2 criteria, examples that affect user data or privacy should include warnings when such behavior is described without caveats.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This section includes locale among values that can be forced via an inline script before React hydrates, but it does not mention preserving user preference, opt-in, or any justified locale restriction. Under the policy, natural-language instructions that imply forcing a locale without user choice can be a language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guidance states that 'Top-left gets seen first (in LTR languages)', which embeds a locale-specific assumption into the design advice. While partially qualified, it does not offer alternative guidance for RTL contexts or indicate that the advice should vary by locale, which can conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.