web-design-guidelines

[Skill Scanner] System prompt extraction attempt This skill's stated purpose and capabilities are coherent and aligned: it fetches a guidelines file and checks user-provided UI files against those rules. The main security concern is the runtime fetch of an authoritative rules document from a single remote location without integrity verification; a compromised guidelines file could change behavior or (if the agent executing the skill were to follow arbitrary instructions embedded in the fetched document) could be used for malicious purposes. There is no direct evidence in the provided fragment of credential harvesting, obfuscated code, command execution, or exfiltration to suspicious domains. Overall risk is low but not zero due to the unverified remote dependency. LLM verification: The skill itself is not directly malicious and aligns with its stated purpose of linting UI files against an external guideline. The main security concerns are operational: (1) runtime fetching of a remote guidelines document introduces supply-chain risk if the upstream repo is compromised or modified; (2) the skill allows reading arbitrary user-specified files without built-in restrictions, which could lead to accidental or malicious disclosure of sensitive files if the agent has broad filesyst