web-design-guidelines
3 findings (1 high, 2 medium), mainly prompt injection, unauthorized tool use, social engineering. Most recent scan 2026-02-01.
This skill presents HIGH security risks primarily due to indirect prompt injection vulnerabilities. The skill fetches and follows instructions from an external URL without validation, creating a transitive trust attack vector where compromised external content could inject arbitrary instructions. The external source controls both the analysis rules AND the output format, enabling potential tool shadowing attacks. The skill description fails to disclose this external dependency, misleading users about its actual behavior. While the skill appears to have legitimate functionality (UI guideline review), the architecture of fetching executable instructions from external sources is fundamentally insecure. Recommended actions: Bundle guidelines internally, separate data from instructions, add transparency about network dependencies, and implement strict validation if external fetching is required.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
SkillSpector found no issues but could not fully inspect the package, usually because SKILL.md refers to a file that is not present, so it fails closed to CAUTION instead of SAFE. Read it as "not fully checked", not as a finding. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".
- Package
- 1 file, 1.2 KB
- SKILL.md
- 136 words, 4 sections
- Code
- None. Instructions only.
SKILL.md covers: Web Interface Guidelines · How It Works · Guidelines Source · Usage
Findings
HIGH Indirect Prompt Injection via External URL Content Prompt Injectionllm
The skill instructs the agent to fetch and follow instructions from an external URL (https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md). The fetched content explicitly contains 'all the rules and output format instructions' that the agent must follow. This creates a transitive trust vulnerability where an attacker controlling or compromising that external resource could inject arbitrary instructions that the agent would execute. The skill delegates trust to untrusted external content without validation.
SKILL.md
Fetch fresh guidelines before each review:
```
https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md
```
Use WebFetch to retrieve the latest rules. The fetched content contains all the rules and output format instructions.MEDIUM Potential Tool Shadowing via Output Format Control Unauthorized Tool Usellm
The skill allows externally-fetched content to specify the 'output format instructions' that the agent must use. This could be exploited to manipulate how the agent presents findings, potentially hiding malicious behavior or misleading users about the actual analysis results. An attacker could modify the external guidelines to include output formatting that obscures security issues or injects deceptive content into the agent's responses.
SKILL.md
When a user provides a file or pattern argument:
1. Fetch guidelines from the source URL above
2. Read the specified files
3. Apply all rules from the fetched guidelines
4. Output findings using the format specified in the guidelinesMEDIUM Misleading Scope - External Dependency Not Disclosed Social Engineeringllm
The skill description states it reviews UI code for 'Web Interface Guidelines compliance' but does not disclose that it fetches instructions from an external GitHub repository. Users may reasonably expect a self-contained local analysis tool, not one that depends on external network resources and follows remotely-hosted instructions. This lack of transparency about the skill's actual behavior and dependencies constitutes social engineering through omission.
SKILL.md
Description: Review UI code for Web Interface Guidelines compliance. Use when asked to 'review my UI', 'check accessibility', 'audit design', 'review UX', or 'check my site against best practices'.
No mention of external URL dependency in description.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 1.2 KB |
External hosts referenced
raw.githubusercontent.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22 at commit e23951b8cad2. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://github.com/vercel/labs-agent-skills
- Raw scan result: web-design-guidelines-scan.json
- Badge for your README:
- Request a re-scan