frontend-ui-dark-ts
Verdict safe, but 1 finding (1 medium), mainly resource abuse. Most recent scan 2026-02-05.
This skill is a frontend development template for building dark-themed React applications. It appears to be primarily documentation-focused, providing code examples, design tokens, and component patterns. No critical security threats were identified. The skill contains no executable scripts (Python/Bash), no network calls, no data exfiltration attempts, no prompt injection, and no malicious code. The main concerns are supply chain related: unpinned package versions create moderate risk of dependency confusion or unexpected updates, and missing metadata (license, compatibility, allowed-tools) reduces transparency. Several referenced files are missing from the package, which could cause user confusion but does not pose a security threat. Overall, this skill is safe to use but would benefit from better dependency management and complete file inclusion.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Build dark-themed React applications using Tailwind CSS with custom theming, glassmorphism effects, and Framer Motion animations. Use when creating dashboards, admin panels, or data-rich interfaces with a refined dark aesthetic.
- Package
- 11 files, 298 KB
- SKILL.md
- 1658 words, 12+ sections
- Code
- None. Instructions only.
SKILL.md covers: Frontend UI Dark Theme (TypeScript) · Stack · Quick Start · Project Structure · Configuration · index.html · public/site.webmanifest · tailwind.config.js · postcss.config.js · src/styles/globals.css · src/main.tsx · src/App.tsx
Findings
MEDIUM Unpinned Package Versions in Dependencies Resource Abusellm
The skill documentation specifies package versions using caret (^) ranges (e.g., 'react: ^18.x', 'framer-motion: ^11.x') rather than exact versions. This creates supply chain risk as future minor/patch versions could introduce breaking changes, vulnerabilities, or unexpected behavior when the skill is used.
SKILL.md
Package versions specified as: react ^18.x, react-dom ^18.x, react-router-dom ^6.x, framer-motion ^11.x, clsx ^2.x, tailwindcss ^3.x, vite ^5.x, typescript ^5.xWhat is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 14 KB |
assets/Segoe UI Bold Italic.ttf | binary | 42 KB |
assets/Segoe UI Bold.ttf | binary | 35 KB |
assets/Segoe UI Italic.ttf | binary | 40 KB |
assets/Segoe UI.ttf | binary | 33 KB |
assets/foundry-logo-dark.png | image | 29 KB |
assets/foundry-logo-light.png | image | 25 KB |
references/acceptance-criteria.md | doc | 8.9 KB |
references/components.md | doc | 26 KB |
references/design-tokens.md | doc | 14 KB |
references/patterns.md | doc | 30 KB |
Package contents recorded 2026-10-22 at commit cfbcbbdc679c. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/microsoft/agent-skills
- Raw scan result: github-skills-frontend-ui-dark-ts-scan.json
- Badge for your README:
- Request a re-scan