Theme Factory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:33 PM UTC
• Version: 1.0.0

Overview

This is a static theme-selection skill, but its README recommends an unpinned remote npx installer that can change after review and run with the user's local privileges.

Review the install path before using it. Prefer a pinned commit or a manual copy of the reviewed Markdown files instead of running the unpinned `npx add` command. Once installed from reviewed files, the skill's behavior is limited to theme guidance and local theme-file reading.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:22

Finding

Unpinned Third-Party Installer and Mutable Remote Source

Content

View full analysis

Vulnerability Details

File Location: README.md:22-24
Vulnerability Type: Insecure third-party dependency and mutable supply-chain source
Risk Level: Medium

Complete Code Snippet:

bash

npx add https://github.com/wpank/ai/tree/main/skills/design-systems/theme-factory

Technical Analysis

The documented installation command uses npx to resolve and potentially execute the package named add. The package is not pinned to an exact version, so the code executed during installation may differ from the version reviewed during this audit.

The command also references a path under a user-controlled GitHub repository without pinning it to an immutable commit SHA or signed release. The effective content obtained by the installation process can therefore change after review. This creates a supply-chain trust boundary involving both the npm-resolved installer and the mutable remote repository.

The reviewed project itself consists only of Markdown files and contains no embedded executable scripts. The risk arises when a user follows the installation instruction, not from normal theme-file processing.

Attack Path

1. An attacker compromises the npm package resolved as add, its maintainer account, or the referenced GitHub repository.
2. The attacker publishes a malicious package version or modifies content reachable through the mutable repository path.
3. A user follows the documented npx add ... installation command.
4. npx downloads and executes the unpinned installer with the user’s local privileges.
5. The compromised installer or source performs unauthorized actions or installs modified Skill content.

Exploitation depends on compromise or malicious modification of an external supply-chain component; no direct compromise path is present in the audited Markdown files themselves.

Impact Assessment

Malicious installation-time code could operate with the privileges of the user running ...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the ambiguous npx add workflow with a documented and verified installer package pinned to an exact version.
2. Pin the repository source to a reviewed commit SHA or a signed, immutable release rather than a mutable branch path.
3. Publish checksum values for release archives and require checksum verification before installation.
4. Prefer a transparent manual installation procedure that copies reviewed static files without executing third-party package code.
5. If an installer remains necessary, document its provenance, inspect its dependency tree and lifecycle scripts, and use package-manager controls that restrict script execution where practical.
6. Avoid recommending elevated privileges for installation and clearly state that the installer should run under a least-privileged user account.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to install from a remote GitHub path via npx add without pinning to a specific immutable version, tag, or commit. That creates a supply-chain risk: if the referenced repository or branch changes, users may unknowingly fetch different or malicious content later.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/theme-factory .cursor/skills/theme-factory

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/theme-factory .claude/skills/theme-factory

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/theme-factory ~/.claude/skills/theme-factory

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: theme-factory
model: fast
description: Curated collection of professional color and typography themes for styling artifacts — slides, docs, reports, landing pages. Use when applying visual themes to presentations, generating themed content, or creating custom brand palettes. Triggers on theme, color palette, font pairing, slide styling, presentation theme, brand colors.
---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description includes very broad trigger terms like 'theme', 'color palette', 'font pairing', and 'brand colors' without any scope limits, which can cause the skill to activate in loosely related contexts. This is not a direct code-execution issue, but it can lead to unintended invocation and inappropriate application of styling behavior where the user did not clearly request it.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

## NEVER Do

- **Apply a theme without confirmation** — always get explicit user selection
- **Mix colors from different themes** — each theme is a cohesive unit
- **Ignore contrast ratios** — readability trumps aesthetics
- **Use accent colors for large text blocks** — accents are for emphasis only

Static analysis

No suspicious patterns detected.