Security audit

Design MD Generator

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent design-extraction purpose, but it opens arbitrary websites in an unsandboxed browser and does not restrict internal URLs or output paths.

Install only if you are comfortable with a skill that opens and executes JavaScript from the URL you provide. Use it only on public or authorized sites, avoid authenticated or internal pages, and run it in an isolated environment with a dedicated output directory until sandboxing, URL validation, and overwrite protections are added.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/extract-tokens.js:25
Finding: Chromium Sandbox Disabled for Attacker-Controlled Web Content
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/extract-tokens.js:14
Finding: Unrestricted URL Navigation Enables Internal and Local Resource Access
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/extract-tokens.js:16
Finding: Unrestricted Output Path Allows Overwriting Arbitrary Writable Files
Content: View full analysis
-1 ? process.argv[outputFlag + 1] : '/tmp/design-tokens.json'; ``` ```javascript fs.writeFileSync(outputPath, JSON.stringify(tokens, null, 2)); ``` ### Technical Analysis The value following `--output` is used directly as the destination for `fs.writeFileSync()`. No validation ensures that the path: - Is present and nonempty - Resides in an approved output directory - Does not contain traversal components - Does not reference a symbolic link - Does not already exist - Is not a sensitive project or user configuration file By default, `writeFileSync()` opens the destination for writing and truncates an existing file. Consequently, any file writable by the process can be replaced with extraction-generated JSON. Although the file contents are structured JSON rather than completely arbitrary bytes, fields such as the target URL, page title, style values, CSS custom-property values, and other extracted strings are influenced by the remote page. At minimum, the flaw permits destructive file corruption. In environment-specific cases, replacing a configuration or data file with partially attacker-influenced JSON could have additional security consequences. A missing argument after `--output` also leaves `outputPath` undefined, causing uncontrolled failure rather than a clear validation error. ### Attack Path 1. An attacker influences the command arguments used to invoke the extraction script. 2. The attacker supplies `--output` followed by the path of a sensitive file writable by the Skill process. 3. The script visits the selected webpage and creates the token object. 4. `fs.writeFileSync()` opens the chosen path and truncates any exist ...[truncated 847 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README explicitly states the skill captures live websites via browser, including screenshots and DOM snapshots, but provides no warning about privacy, authorization, or handling of potentially sensitive page content. In practice, users may point this at authenticated, internal, or personal pages, causing collection and persistence of sensitive UI data, tokens rendered in-page, or proprietary design assets without informed consent or clear safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Marketing the tool as a one-click way to extract the design language of 'any website' encourages broad scraping behavior without disclosing privacy, copyright, permission, or acceptable-use constraints. In the context of a skill designed to reverse-engineer visual systems, this omission increases the chance of misuse against non-public, restricted, or legally protected content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states the skill will load arbitrary websites, take screenshots, capture DOM snapshots, and extract CSS, but it does not warn users about privacy, data handling, authorization, or site-specific restrictions. This can lead operators to collect sensitive page contents or process protected material without realizing the legal, privacy, or policy implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises broad trigger phrases like 'extract design system' and 'capture the look of a website', which can cause the agent to invoke it in situations where the user did not clearly consent to browsing a third-party URL and extracting site data. Because the skill performs external navigation and token extraction, accidental invocation increases the chance of unintended network access and data collection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The workflow instructs the agent to navigate to an arbitrary target URL, take screenshots, snapshot the page, and run a token-extraction script, but the skill description does not warn users that it will access external websites and collect design data from them. This is dangerous because users may unknowingly trigger network access to sensitive, internal, authenticated, or otherwise non-public pages, leading to unintended exposure of visual and structural information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script accepts an arbitrary user-supplied URL and automatically opens it in a headless browser, executing page JavaScript and collecting computed style data from the visited page. In an agent/automation context, this can trigger unintended outbound network access to internal or sensitive endpoints, leak browsing metadata, and capture more page-derived information than a user may expect, even though the intended purpose is design-token extraction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The output section says the generated DESIGN.md should be saved to a user-specified target location, with optional preview files, but it does not clearly warn that the skill writes files to disk. Unclear file-write behavior can cause accidental overwrites, placement in sensitive directories, or unexpected artifact creation, especially when combined with optional HTML outputs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.