Design System Patterns

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:34 PM UTC
• Version: 1.0.0

Overview

The skill content is ordinary design-system guidance, but its README recommends an unpinned executable install from a mutable GitHub branch.

Review the install path before using this skill. Prefer a ClawHub-reviewed install or pin the README command to a specific installer version and commit hash with an integrity check. The design examples themselves are ordinary, but treat the inline theme script as static trusted code only and adapt the sample language setting to your app.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned Third-Party Package Execution During Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 24–28
Vulnerability Type: Unpinned executable dependency and mutable remote source
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/design-systems/design-system-patterns

text

### Technical Analysis

The installation instructions invoke the npm package named `add` through `npx`. Because no exact package version or integrity value is specified, `npx` may download and execute whichever package release the registry currently resolves. npm package lifecycle or command code executes with the permissions of the user running the installation.

The argument also references the mutable `main` branch of a remote GitHub repository rather than an immutable commit. Consequently, both the executable installer and the content it processes can change after this audit without any modification to the reviewed project.

This creates a supply-chain trust gap. The finding does not establish that the current package or repository is malicious; the vulnerability is that the documented command permits future, compromised, or unexpectedly changed third-party content to execute during installation.

### Attack Path

1. An attacker compromises the npm account or package resolved by `npx add`, publishes a malicious release, or compromises the referenced GitHub repository.
2. The attacker adds malicious installer behavior or substitutes malicious Skill content.
3. A user follows the documented installation command.
4. `npx` resolves and downloads the unpinned package, then executes it locally.
5. The malicious process operates with the invoking user's permissions and can access resources available to that user.

### Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's privilege
...[truncated 441 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not execute an implicitly resolved npm package. Use a reviewed installer pinned to an exact version, for example package-name@x.y.z.
2. Pin remote repository content to a full immutable commit SHA instead of the mutable main branch.
3. Where supported, verify the downloaded artifact using a published cryptographic checksum or signature before processing it.
4. Prefer non-executable installation instructions that copy reviewed local files into the destination directory.
5. If an installer is necessary, document its package owner, source repository, expected integrity value, and minimum required privileges.
6. Run installation in a restricted environment without unnecessary secrets, elevated permissions, or broad filesystem access.
7. Add automated dependency and provenance checks so changes to the installer or source artifact require explicit review.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 65% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.

md

// In layout.tsx
<html lang="en" suppressHydrationWarning>
  <head>
    <script dangerouslySetInnerHTML={{ __html: themeScript }} />
  </head>
  <body><ThemeProvider>{children}</ThemeProvider></body>
</html>

Unvalidated Output Injection

High

• Category: Output Handling
• Confidence: 65% confidence

Finding

Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Content

Scanner excerpt · references/theming-architecture.md (reported line 459)May include surrounding context.

md

// In layout.tsx
<html lang="en" suppressHydrationWarning>
  <head>
    <script dangerouslySetInnerHTML={{ __html: themeScript }} />
  </head>
  <body><ThemeProvider>{children}</ThemeProvider></body>
</html>

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to install the skill via npx add pointing at a GitHub URL without any pinned version, commit hash, or integrity control. That makes the installed content mutable over time, so a repository compromise, force-push, or upstream change could cause users to fetch and trust different code than originally reviewed.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 37)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/design-system-patterns .cursor/skills/design-system-patterns

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/design-system-patterns .claude/skills/design-system-patterns

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/design-system-patterns ~/.claude/skills/design-system-patterns

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: design-system-patterns
model: standard
description: Foundational design system architecture — token hierarchies, theming infrastructure, token pipelines, and governance. Use when creating design tokens, implementing theme switching, setting up Style Dictionary, or establishing multi-brand theming. Triggers on design tokens, theme provider, Style Dictionary, token pipeline, multi-brand theming, CSS custom properties architecture.
---

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example sets <html lang="en">, which forces an English language/locale setting in the provided implementation snippet. The file does not indicate that this is optional, user-configurable, or justified by a region-specific requirement, so it conflicts with the policy against unprompted locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The SSR example sets <html lang="en">, which forces an English locale in the sample markup. Under the policy, locale constraints should either be optional/user-selectable or clearly justified; this example provides neither.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.