Design System Creation

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:37 PM UTC
• Version: 1.0.0

Overview

The design-system skill content is coherent and not malicious, but its installation instructions recommend mutable npx and GitHub sources that can execute unreviewed code.

Review the skill content as a design-system workflow, but avoid running the documented unpinned npx/GitHub install commands unless you trust the current package and repository state. Prefer a pinned package version or immutable commit and inspect the downloaded skill before enabling it globally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned ClawHub Package Is Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17 and README.md:30
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install design-system-creation

Technical Analysis

The documented installation command instructs npx to retrieve and execute the mutable latest release of the third-party clawhub package. The package version and integrity are not pinned to an artifact reviewed as part of this audit.

The behavior of the installation process can therefore change without any modification to this repository. If the npm package, publisher account, release pipeline, or package registry is compromised, a malicious release could be selected by the latest tag. Running the command would execute the retrieved package's CLI code and potentially its npm lifecycle scripts.

Attack Path

1. An attacker compromises the clawhub npm publisher account, package pipeline, or another component of its distribution chain.
2. The attacker publishes a malicious package version and assigns it to the latest distribution tag.
3. A user follows the installation instructions in SKILL.md or README.md.
4. npx downloads the attacker-controlled version.
5. The malicious package executes with the privileges of the user running the installation command.
6. The package can alter project files, access user-readable information, install modified Skill instructions, or perform other actions available to that user.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The accessible scope may include the current project, user-owned configuration and credential files, environment variables, and other resources available to that account. The command does not directly request elevated privileges, so system-wide impact depends on the user's existing permissions and execution env ...[truncated 9 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact, reviewed package version.
• Verify the package's publisher, repository, and release provenance before recommending it.
• Use npm lockfiles and integrity metadata where the installation workflow supports them.
• Prefer a workflow that downloads a fixed artifact for inspection before executing it.
• Document the expected package checksum or signature and require verification.
• Run installation in a restricted environment with only the filesystem and network permissions necessary for the task.
• Periodically review pinned dependency versions and update them only after security validation.

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Mutable GitHub Content Is Installed Through an Unpinned npx Package

Content

View full analysis

Vulnerability Details

File Location: README.md:24
Vulnerability Type: Unpinned dependency and mutable remote installation source
Risk Level: Medium

Vulnerable Code

bash

npx add https://github.com/wpank/ai/tree/main/skills/meta/design-system-creation

Technical Analysis

This command invokes an unversioned package named add through npx and supplies content from the mutable main branch of an external GitHub repository. Neither the executable npm package nor the remote repository content is pinned to a reviewed immutable version.

Consequently, both the installer behavior and installed Skill content can change after this audit. A compromise of the npm package, its publisher, the GitHub account, the repository, or its branch protections could cause users to execute malicious installer logic or install attacker-controlled Skill instructions.

Attack Path

1. An attacker compromises the npm package used by npx add, the associated publisher, or the referenced GitHub repository.
2. The attacker publishes malicious installer code or modifies content under the repository's main branch.
3. A user runs the documented command.
4. npx retrieves and executes the current version of the unpinned add package.
5. The installer retrieves content currently available at the mutable GitHub location.
6. Malicious installer code may execute immediately, or malicious Skill content may be installed and later loaded by an AI agent.
7. Immediate code execution would inherit the user's permissions; malicious installed instructions could subsequently influence agent operations within their granted tool access.

Impact Assessment

Compromise of the executable npm dependency could result in arbitrary code execution with the installing user's privileges. Compromise of only the GitHub content could install altered instructions that affect later agent sessions. Potential exposure includes project files, ...[truncated 155 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer package to an exact, reviewed npm version rather than invoking an unversioned package name.
• Replace the GitHub main branch URL with an immutable, reviewed commit reference.
• Publish and verify cryptographic checksums or signed release artifacts.
• Clearly identify the expected installer package publisher and source repository.
• Download and inspect remote Skill content before placing it in an agent's active Skill directory.
• Disable or restrict npm lifecycle scripts where feasible.
• Perform installation in a sandbox with limited filesystem, credential, and network access.
• Establish a controlled update process so changes to either the installer or Skill content require a new security review.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute a remote package/tool via npx add from a GitHub URL without pinning an immutable version or commit. This creates a supply-chain risk: if the referenced content changes or is compromised later, users may install unexpected or malicious code or artifacts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command npx clawhub@latest install design-system-creation relies on the mutable latest tag, which can change over time and cause users to run unreviewed code. If the package or dependency chain is compromised, this becomes a straightforward supply-chain execution vector.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/meta/design-system-creation .cursor/skills/design-system-creation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/meta/design-system-creation .claude/skills/design-system-creation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/meta/design-system-creation ~/.claude/skills/design-system-creation

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: design-system-creation
model: reasoning
description: Complete workflow for creating distinctive design systems from scratch. Orchestrates aesthetic documentation, token architecture, components, and motion. Use when starting a new design system or refactoring an existing one. Triggers on create design system, design tokens, design system setup, visual identity, theming.
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger description includes broad phrases like 'create design system', 'visual identity', and 'theming', which can cause the skill to activate in many ordinary design conversations. Over-broad activation increases the chance of unintended invocation, context hijacking, or the skill influencing tasks beyond what the user explicitly requested.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at runtime rather than a pinned, reviewed release. This creates a supply-chain risk: a compromised publisher account, malicious update, or breaking change could cause arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.