Frontend Design

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 4:35 PM UTC
• Version: 1.0.0

Overview

This is a frontend design guidance skill with no bundled executable code, though its mutable install commands should be handled cautiously.

Install from a reviewed or pinned source when possible, and avoid running the `npx` installation commands with elevated privileges or in environments containing sensitive secrets. Once installed, the skill itself is design guidance and does not ask to access private data or perform hidden actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:22

Finding

Mutable Package Version Executed Through npx

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:22-25
• README.md:29-32

Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:22-25:

bash

### OpenClaw / Moltbot / Clawbot

```bash
npx clawhub@latest install frontend-design

text

`README.md:29-32`:

```bash
### OpenClaw / Moltbot / Clawbot

```bash
npx clawhub@latest install frontend-design

text

### Technical Analysis

The installation instructions direct users to execute `clawhub@latest` through `npx`. The `latest` distribution tag is mutable and does not identify a fixed, previously reviewed package version. Depending on the local npm configuration and cache state, `npx` can download the selected package from the configured registry and execute its command, including applicable package installation behavior.

The effective code executed by this command is not present in the audited project. Consequently, it can change after this Skill has been reviewed without requiring any modification to `SKILL.md` or `README.md`. Although no malicious package content was found in the audited files, this creates a supply-chain trust boundary and exposes users to a compromised package release, registry account, maintainer account, or package ownership transfer.

### Attack Path

1. An attacker compromises the `clawhub` package, its publisher account, or its upstream release process.
2. The attacker publishes a malicious version and assigns or causes the `latest` tag to reference it.
3. A user follows the documented installation command.
4. `npx` resolves `clawhub@latest` to the attacker-controlled version and downloads it.
5. The package executes with the privileges of the user running the command.
6. The payload can access data and resources available to that user.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's 
...[truncated 574 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact package version, such as clawhub@X.Y.Z.
• Verify package provenance, signatures, and integrity metadata before execution.
• Document the expected package checksum or signed release identity through a trusted channel.
• Review package contents and lifecycle scripts before promoting a new pinned version.
• Run installation with a non-privileged account in an isolated environment.
• In CI, restrict network access and secrets available to installation steps.
• Keep the pinned version synchronized in both SKILL.md and README.md.

T08 · Insecure Dependencies

Warning

• Location: README.md:23

Finding

Installation Delegates to Mutable External Repository Content

Content

View full analysis

Vulnerability Details

File Location: README.md:23-26
Vulnerability Type: Unverified external dependency source
Risk Level: Medium

Vulnerable Code

bash

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/frontend/frontend-design

text

### Technical Analysis

The installation command invokes the external `add` package through `npx` and supplies a GitHub path that references the mutable `main` branch. Neither the `add` executable nor the repository content is pinned to an immutable, reviewed version. The repository content retrieved during a future installation can therefore differ from the content available when this project was audited.

Executing an installation helper also introduces an additional dependency boundary: users must trust both the npm package resolved for `add` and the remote repository content it processes. The audited project does not contain either dependency, so their behavior and future updates could not be verified as part of this review.

### Attack Path

1. An attacker compromises the npm package resolved as `add`, its publisher, the referenced GitHub repository, or an authorized repository maintainer.
2. The attacker modifies the installation helper or commits malicious content to the referenced `main` branch.
3. A user executes the documented command.
4. `npx` obtains and executes the installation helper, which retrieves or processes the mutable repository content.
5. Attacker-controlled code or Skill instructions are installed into the user's environment.
6. Any executable installation behavior runs with the user's privileges, while malicious Skill instructions could affect later agent sessions when the installed Skill is loaded.

### Impact Assessment

If the external installer executes malicious code, exploitation could result in arbitrary code execution with the installing user's privileges, exposing accessible files, credentials, enviro
...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installation helper to an exact, reviewed package version.
• Replace the mutable main reference with an immutable Git commit hash or signed release tag.
• Verify the downloaded artifact using a published checksum or cryptographic signature.
• Prefer downloading and inspecting the Skill artifact before placing it in an agent's Skill directory.
• Document the expected source repository, commit identifier, and integrity value.
• Avoid running the installer with administrator privileges.
• Isolate installation in a sandbox or container and prevent access to unrelated credentials.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# Frontend Design

Create memorable frontend interfaces that stand out from generic AI-generated aesthetics through bold creative choices.

## What's Inside

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The README instructs users to execute remote package tooling via npx add against a GitHub URL without pinning to a specific immutable version, tag, or commit. This creates a supply-chain risk because future upstream changes could cause different code to be fetched and executed than what was originally reviewed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command npx clawhub@latest install frontend-design uses the mutable latest tag, which can resolve to different code over time. If the package or one of its dependencies is compromised or updated unexpectedly, users may run unreviewed code during installation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 57)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/frontend/frontend-design .claude/skills/frontend-design

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/frontend/frontend-design ~/.claude/skills/frontend-design

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: frontend-design
model: reasoning
version: 1.1.0
description: >
  Create distinctive, production-grade frontend interfaces that avoid generic "AI slop"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest install frontend-design, which fetches and executes the latest package version at runtime rather than a pinned, reviewed release. If the upstream package is compromised or a breaking/malicious version is published, users of this skill could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Because this is a markdown file, trigger-scope guidance applies. Phrases like 'Building a new component, page, or web application' and especially 'Any frontend work where visual impact matters' are very broad and do not clearly distinguish when this skill should be invoked versus a more general UI/frontend skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.