ClawHub
Back to skill

Security audit

clawlite-design-consult

Security checks for vulnerabilities and agentic risk

Overview

This skill is a design-consulting helper that reads project context and creates design documentation, with expected preview and file-writing behavior users should review.

Install this if you want a repo-aware design-system consultant. Be comfortable with it reading ordinary project context, optionally browsing competitor sites, opening a local HTML preview that may load Google Fonts, and modifying DESIGN.md and CLAUDE.md. Review generated files before committing, especially CLAUDE.md because it can influence future agent behavior.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
81% confidence
Finding
The skill directs the agent to generate a local HTML file, open it automatically, and load external fonts from Google Fonts CDN. Auto-opening a generated file can trigger unintended active content rendering, and external font/CDN loading causes network egress that may disclose usage context or embed unreviewed remote dependencies into a supposedly local preview flow.

Static analysis

No suspicious patterns detected.