Security audit

bold-ui

Security checks for vulnerabilities and agentic risk

Overview

This design helper is mostly coherent, but it can import user-supplied GitHub templates into persistent local agent state and fetch remote SVG icons, so it should be reviewed before installation.

Install only if you are comfortable with a design skill that can contact third-party services and persist imported templates for future use. Use add-temp only with repositories you trust, review imported manifest and description files before installation, and prefer local icon fallbacks in restricted or sensitive environments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a UI beautification/template application tool, but it also includes instructions to import arbitrary templates from GitHub and mutate persistent template registries. This expands the skill from local design assistance into remote content ingestion and system state modification, increasing supply-chain and persistence risk beyond what a user would reasonably infer from the manifest.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill contains shell-oriented instructions to clone remote repositories, copy files into user directories, and remove temporary directories. For a design skill, these actions are high risk because they enable remote content intake, local persistence, and destructive file operations that could be misapplied or abused if paths or inputs are mishandled.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The skill instructs the agent to fetch icons from Iconify over the network, which is an external data transmission not clearly disclosed in the core skill scope. Even if limited to icon retrieval, it introduces privacy, dependency, and integrity risks because project context or usage patterns may indirectly be exposed to a third-party service.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The adapter documentation expands from local Tailwind theming into instructing network access to a third-party icon API. In an agent skill, this is security-relevant because it can cause unsolicited outbound requests, leak project usage metadata, and introduce unreviewed remote content into generated code even though the stated purpose is local UI/theme generation.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: Including icon-download capability is outside the minimum scope needed for Tailwind configuration and component generation. That scope creep increases attack surface by enabling network activity and ingestion of third-party SVG content, which may later be inlined or trusted without adequate validation.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The activation criteria are broad enough to trigger on common design-related requests, which increases the chance the skill runs in ordinary conversations without the user understanding its side effects. In this skill, that matters because later instructions include network access and filesystem modifications, making overbroad activation more dangerous than a purely advisory skill.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill describes cloning GitHub repositories, copying files into persistent directories, and updating registries without a prominent safety warning or consent checkpoint. Users may not realize a design assistance skill can modify the local system, creating a transparency and authorization problem around persistent changes.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The adapter instructs users to fetch icons from a third-party service without clearly warning that this causes outbound network access and shares request metadata with an external provider. In an agent or enterprise environment, silent external fetch guidance can violate privacy, egress-control, or offline-build requirements even if the transmitted data is limited.

External Transmission

Medium

Category: Data Exfiltration
Content: | Template source | Iconify prefix | Example URL | |----------------|---------------|-------------| | lucide | `lucide` | `https://api.iconify.design/lucide/search.svg` | | phosphor | `ph` | `https://api.iconify.design/ph/magnifying-glass.svg` | | heroicons | `heroicons-outline` / `heroicons-solid` | `https://api.iconify.design/heroicons-outline/search.svg` | | feather | `feather` | `https://api.iconify.design/feather/search.svg` |
Confidence: 86% confidence
Finding: This URL documents use of an external service, which would cause outbound communication if followed by an agent or user. In this skill context, external transmission is more dangerous because the adapter is expected to transform local design tokens, not contact third-party services, so the network behavior is unexpected and unnecessary.

External Transmission

Medium

Category: Data Exfiltration
Content: | Template source | Iconify prefix | Example URL | |----------------|---------------|-------------| | lucide | `lucide` | `https://api.iconify.design/lucide/search.svg` | | phosphor | `ph` | `https://api.iconify.design/ph/magnifying-glass.svg` | | heroicons | `heroicons-outline` / `heroicons-solid` | `https://api.iconify.design/heroicons-outline/search.svg` | | feather | `feather` | `https://api.iconify.design/feather/search.svg` | | tabler | `tabler` | `https://api.iconify.design/tabler/search.svg` |
Confidence: 86% confidence
Finding: This finding points to another documented third-party API endpoint, reinforcing that the adapter encourages outbound requests to fetch assets. Such behavior can disclose metadata and add supply-chain risk through remote content retrieval not essential to Tailwind theming.

External Transmission

Medium

Category: Data Exfiltration
Content: |----------------|---------------|-------------| | lucide | `lucide` | `https://api.iconify.design/lucide/search.svg` | | phosphor | `ph` | `https://api.iconify.design/ph/magnifying-glass.svg` | | heroicons | `heroicons-outline` / `heroicons-solid` | `https://api.iconify.design/heroicons-outline/search.svg` | | feather | `feather` | `https://api.iconify.design/feather/search.svg` | | tabler | `tabler` | `https://api.iconify.design/tabler/search.svg` |
Confidence: 86% confidence
Finding: The documentation includes a further external API reference for icon retrieval, indicating a repeated pattern of network-enabled behavior. Repetition increases the likelihood an agent will treat remote fetching as standard workflow and perform it without sufficient review.

External Transmission

Medium

Category: Data Exfiltration
Content: | lucide | `lucide` | `https://api.iconify.design/lucide/search.svg` | | phosphor | `ph` | `https://api.iconify.design/ph/magnifying-glass.svg` | | heroicons | `heroicons-outline` / `heroicons-solid` | `https://api.iconify.design/heroicons-outline/search.svg` | | feather | `feather` | `https://api.iconify.design/feather/search.svg` | | tabler | `tabler` | `https://api.iconify.design/tabler/search.svg` | ```
Confidence: 86% confidence
Finding: This external endpoint again encourages downloading remote SVG assets. Remote SVGs are content inputs that may be trusted and inlined into application code, creating avoidable exposure to malicious or malformed content from third-party infrastructure.

External Transmission

Medium

Category: Data Exfiltration
Content: | phosphor | `ph` | `https://api.iconify.design/ph/magnifying-glass.svg` | | heroicons | `heroicons-outline` / `heroicons-solid` | `https://api.iconify.design/heroicons-outline/search.svg` | | feather | `feather` | `https://api.iconify.design/feather/search.svg` | | tabler | `tabler` | `https://api.iconify.design/tabler/search.svg` | ``` # Fetch icon SVG from Iconify (returns raw SVG, ready to inline)
Confidence: 87% confidence
Finding: This line continues the pattern of directing the skill toward external API usage for assets. Within a UI adapter, that is an unjustified data flow outward and broadens the trust boundary beyond the local project and installed dependencies.

External Transmission

Medium

Category: Data Exfiltration
Content: ``` # Fetch icon SVG from Iconify (returns raw SVG, ready to inline) curl -s "https://api.iconify.design/lucide/search.svg?height=24" ``` Style the SVG icon with Tailwind utility classes:
Confidence: 92% confidence
Finding: The explicit curl command operationalizes the external transmission by providing a ready-made way to fetch raw SVG from a third-party endpoint. In an agent setting, executable-looking network commands materially increase risk because they can be copied or automated directly, causing unapproved outbound traffic and importing untrusted content.

Static analysis

No suspicious patterns detected.