Distinctive Design Systems

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:33 PM UTC
• Version: 1.0.0

Overview

This is a design-guidance skill with no hidden runtime code, though its README installation command should be treated carefully because it uses mutable, unpinned sources.

Review the install command before using it. Prefer an immutable release, pinned installer version, or manual installation from a verified copy if supply-chain risk matters in your environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:25
• Finding: Unpinned Third-Party Installer and Mutable Remote Source## Vulnerability Details **File Location**: `README.md`, line 25 **Vulnerability Type**: Supply-chain risk from an unpinned installer and mutable remote source **Risk Level**: Medium ### Vulnerable Code ```bash npx add https://github.com/wpank/ai/tree/main/skills/design-systems/distinctive-design-systems ``` ### Technical Analysis The documented installation command invokes `npx add` without specifying an audited package version or integrity value. If the `add` package is not already available locally, `npx` may download and execute it from the configured npm registry under the installing user's account. The command also obtains Skill content from the mutable GitHub `main` branch rather than an immutable commit or verified release artifact. The installer implementation and installed Skill content can therefore change after this audit without any modification to the audited repository. No malicious payload was present in the two audited files. The vulnerability is the installation process's reliance on unpinned third-party components and mutable upstream content. ### Attack Path 1. An attacker compromises the npm package or account supplying the unpinned `add` executable, the referenced GitHub repository, or an authorized upstream maintainer account. 2. The attacker publishes a malicious installer version or modifies content on the referenced `main` branch. 3. A user follows the installation command in `README.md`. 4. `npx` resolves and potentially executes the attacker-controlled installer, which then retrieves mutable remote content. 5. The malicious installer can run commands with the invoking user's privileges, or the substituted Skill can introduce malicious instructions that affect later agent sessions. ### Impact Assessment Successful exploitation could allow arbitrary command execution with the privileges of the user running the installation command. Accessible scope may include that user's project files, home-directory data, environment variab ...[truncated 354 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer to a specifically reviewed version instead of invoking an unversioned package: ```bash npx --yes add@<audited-version> <source> ``` 2. Replace the mutable `main` reference with an immutable, reviewed Git commit or versioned release artifact. 3. Publish and verify a cryptographic checksum or signature for the downloaded artifact before installation. 4. Use npm lockfiles and integrity metadata where applicable, and review the installer package's provenance and lifecycle scripts. 5. Prefer a manual installation procedure from a verified release archive when installer execution is unnecessary. 6. Run installation with least privilege in an isolated environment; do not use an administrator or root account. 7. Add automated monitoring or reproducible verification to detect changes in upstream installer behavior and Skill content.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Session Persistence

Medium

• Category: Rogue Agent

Content

From your project root:

```bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems .cursor/skills/distinctive-design-systems
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

From your project root:

```bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems .claude/skills/distinctive-design-systems
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

#### Claude Code (global)

```bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems ~/.claude/skills/distinctive-design-systems
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Model or Provider Selection

Medium

• Category: Excessive Agency

Content

---
name: distinctive-design-systems
model: reasoning
description: Patterns for creating design systems with personality and distinctive aesthetics. Covers aesthetic documentation, color token architecture, typography systems, layered surfaces, and motion. Use when building design systems that go beyond generic templates. Triggers on design system, design tokens, aesthetic, color palette, typography, CSS variables, tailwind config.
---

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The manifest description says the skill 'Triggers on design system, design tokens, aesthetic, color palette, typography, CSS variables, tailwind config.' Several of these terms, especially 'aesthetic', 'typography', and 'design system', are broad and commonly used in normal design discussions, which could cause unintended invocation without clearer scope or exclusions.

Static analysis

No suspicious patterns detected.