ClawHub
Back to skill

Security audit

Distinctive Design Systems

Security checks for vulnerabilities and agentic risk

Overview

This is a design-guidance skill with no hidden runtime code, though its README installation command should be treated carefully because it uses mutable, unpinned sources.

Review the install command before using it. Prefer an immutable release, pinned installer version, or manual installation from a verified copy if supply-chain risk matters in your environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:25
Finding

Unpinned Third-Party Installer and Mutable Remote Source

Content
View full analysis

Vulnerability Details

File Location: README.md, line 25
Vulnerability Type: Supply-chain risk from an unpinned installer and mutable remote source
Risk Level: Medium

Vulnerable Code

bash
npx add https://github.com/wpank/ai/tree/main/skills/design-systems/distinctive-design-systems

Technical Analysis

The documented installation command invokes npx add without specifying an audited package version or integrity value. If the add package is not already available locally, npx may download and execute it from the configured npm registry under the installing user's account.

The command also obtains Skill content from the mutable GitHub main branch rather than an immutable commit or verified release artifact. The installer implementation and installed Skill content can therefore change after this audit without any modification to the audited repository.

No malicious payload was present in the two audited files. The vulnerability is the installation process's reliance on unpinned third-party components and mutable upstream content.

Attack Path

  1. An attacker compromises the npm package or account supplying the unpinned add executable, the referenced GitHub repository, or an authorized upstream maintainer account.
  2. The attacker publishes a malicious installer version or modifies content on the referenced main branch.
  3. A user follows the installation command in README.md.
  4. npx resolves and potentially executes the attacker-controlled installer, which then retrieves mutable remote content.
  5. The malicious installer can run commands with the invoking user's privileges, or the substituted Skill can introduce malicious instructions that affect later agent sessions.

Impact Assessment

Successful exploitation could allow arbitrary command execution with the privileges of the user running the installation command. Accessible scope may include that user's project files, home-directory data, environment variab ...[truncated 354 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the installer to a specifically reviewed version instead of invoking an unversioned package:
    bash
    npx --yes add@<audited-version> <source>
  2. Replace the mutable main reference with an immutable, reviewed Git commit or versioned release artifact.
  3. Publish and verify a cryptographic checksum or signature for the downloaded artifact before installation.
  4. Use npm lockfiles and integrity metadata where applicable, and review the installer package's provenance and lifecycle scripts.
  5. Prefer a manual installation procedure from a verified release archive when installer execution is unnecessary.
  6. Run installation with least privilege in an isolated environment; do not use an administrator or root account.
  7. Add automated monitoring or reproducible verification to detect changes in upstream installer behavior and Skill content.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

From your project root:

bash
mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems .cursor/skills/distinctive-design-systems

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

From your project root:

bash
mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems .claude/skills/distinctive-design-systems

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

Claude Code (global)

bash
mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/distinctive-design-systems ~/.claude/skills/distinctive-design-systems

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: distinctive-design-systems
model: reasoning
description: Patterns for creating design systems with personality and distinctive aesthetics. Covers aesthetic documentation, color token architecture, typography systems, layered surfaces, and motion. Use when building design systems that go beyond generic templates. Triggers on design system, design tokens, aesthetic, color palette, typography, CSS variables, tailwind config.
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest description says the skill 'Triggers on design system, design tokens, aesthetic, color palette, typography, CSS variables, tailwind config.' Several of these terms, especially 'aesthetic', 'typography', and 'design system', are broad and commonly used in normal design discussions, which could cause unintended invocation without clearer scope or exclusions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.