Web Design

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:34 PM UTC
• Version: 1.0.0

Overview

The skill content is ordinary web-design guidance, but its install instructions rely on mutable unpinned remote executors that users should review before running.

Review and preferably pin the installer versions and repository commit before installing. Avoid running the npx commands in an environment with unnecessary secrets, and choose the manual per-project copy path when you can verify the source files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Remote Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-22
Additional Location: README.md:33-37
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

markdown

### OpenClaw / Moltbot / Clawbot

```bash
npx clawhub@latest install web-design

text

### Technical Analysis

The installation instructions execute the mutable `latest` release of the `clawhub` npm package through `npx`. If that package is not already available locally, `npx` can download and execute it directly from the configured npm registry.

The `latest` tag is mutable and does not identify the exact package version reviewed by the project author. No lockfile, integrity hash, checksum, or signature verification is provided. Consequently, the code that executes when a user follows these instructions can change after this Skill has been audited.

This is a supply-chain weakness rather than evidence that the currently published package is malicious.

### Attack Path

1. An attacker compromises the `clawhub` npm package, its publisher account, or the associated registry distribution channel.
2. The attacker publishes a malicious release and assigns the mutable `latest` tag to it.
3. A user follows the documented installation command.
4. `npx` resolves `clawhub@latest`, downloads the attacker-controlled release, and runs its CLI or lifecycle behavior.
5. The malicious package executes with the operating-system privileges of the user running the installation.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions and environment, the malicious package could read or modify accessible files, steal developer credentials and environment variables, alter project content, install additional dependencies, or tamper with local development tools. The command itself does not request elevated privileges, so the direct privilege boundary is n
...[truncated 51 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, such as clawhub@X.Y.Z.
• Publish and verify the expected package integrity hash or cryptographic signature.
• Document the trusted npm registry from which the package must be obtained.
• Review the pinned package's lifecycle scripts, transitive dependencies, and CLI entry point before recommending execution.
• Use a lockfile or another reproducible installation mechanism where supported.
• Apply the same correction to the duplicate command in README.md:33-37.
• Recommend running installation with a non-privileged account and without unnecessary secrets in the environment.

T08 · Insecure Dependencies

Warning

• Location: README.md:27

Finding

Unpinned npm Executor Retrieves Content From a Mutable Repository Branch

Content

View full analysis

Vulnerability Details

File Location: README.md:27-30
Vulnerability Type: Unverified package executor and mutable remote source
Risk Level: Medium

Vulnerable Code

markdown

## Installation

```bash
npx add https://github.com/wpank/ai/tree/main/skills/design-systems/web-design

text

### Technical Analysis

This command has two independent supply-chain trust problems:

1. `npx add` does not pin the npm package that supplies the `add` executable to an exact reviewed version.
2. The requested GitHub content is referenced through the mutable `main` branch rather than an immutable commit.

No checksum, package integrity value, commit hash, or signature is specified. The actual executor behavior and repository content can therefore change after review. A compromise of the relevant npm namespace, package publisher, GitHub account, repository, or branch could cause users to execute unreviewed behavior or install hostile Skill content.

Because the repository URL points to a directory-style GitHub web URL, the precise behavior also depends on the remotely obtained `add` utility, increasing ambiguity and reliance on unverified external implementation.

### Attack Path

1. An attacker compromises either the npm package that provides the `add` command or the referenced GitHub repository.
2. The attacker modifies the executor package, changes the repository's `main` branch, or both.
3. A user copies and executes the documented command.
4. `npx` obtains and runs the unpinned executor.
5. The executor retrieves content from the mutable repository reference.
6. Attacker-controlled code or Skill instructions are installed or processed in the user's environment.

### Impact Assessment

If the npm executor is compromised, exploitation could result in arbitrary code execution with the invoking user's permissions, allowing access to files, credentials, environment variables, and development resources available to that user.

If only the repository content
...[truncated 331 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ambiguous npx add command with a documented, trusted installer pinned to an exact package version.
• Reference the repository using an immutable commit hash rather than the main branch.
• Publish a checksum or signed manifest for the expected Skill files and verify it before installation.
• Use an official package registry or release artifact with provenance metadata where possible.
• Document the expected publisher, repository owner, commit identifier, and verification procedure.
• Audit the installer's lifecycle scripts and transitive dependencies.
• Avoid executing the installer with elevated privileges or in an environment containing unnecessary credentials.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md

### Anatomy of a Well-Designed Component

Every UI component should have clear states, consistent spacing, and predictable behavior:

| State | Visual Treatment | Example |
|---|---|---|

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 45)May include surrounding context.

From your project root:

bash

mkdir -p .cursor/skills
cp -r ~/.ai-skills/skills/design-systems/web-design .cursor/skills/web-design

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 61)May include surrounding context.

From your project root:

bash

mkdir -p .claude/skills
cp -r ~/.ai-skills/skills/design-systems/web-design .claude/skills/web-design

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

Claude Code (global)

bash

mkdir -p ~/.claude/skills
cp -r ~/.ai-skills/skills/design-systems/web-design ~/.claude/skills/web-design

External Model or Provider Selection

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: web-design
model: standard
description: CSS implementation patterns for layout, typography, color, spacing, and responsive design. Complements ui-design (fundamentals) with code-focused examples.
version: "1.1.0"
related: [ui-design, frontend-design, design-system-patterns]

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses npx clawhub@latest, which pulls and executes the newest published package version at runtime rather than a reviewed, fixed version. This creates a supply-chain risk: if the package is compromised or a breaking/malicious release is published, users installing the skill could execute untrusted code immediately.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.