web-design-guidelines

The skill manifest presents itself as a local code review tool, but the actual implementation fetches guidelines from an external GitHub URL at runtime without version pinning. This creates a supply chain vulnerability where an attacker could compromise the GitHub repository or perform a man-in-the-middle attack to inject malicious rules into the guidelines that would then be executed against user files.

fix Pin the guidelines to a specific commit hash (e.g., github.com/.../web-interface-guidelines@<commit-hash>) rather than 'main'. Alternatively, include the guidelines directly in the skill rather than fetching them at runtime. If fetching is necessary, implement content validation and hash verification of the fetched guidelines.

A UI code review tool performing unannounced network requests to GitHub is suspicious and violates the principle of least privilege. Users may not expect external network calls from what appears to be a local analysis tool, and this creates opportunities for data exfiltration or execution of untrusted content fetched over the network.

fix Either eliminate the network fetch requirement by embedding guidelines in the skill, or explicitly disclose to users that the skill requires network access and obtain informed consent. Implement TLS certificate pinning and validate the integrity of fetched content using cryptographic signatures.

This is the most severe finding. The skill unconditionally fetches and uses guidelines from a GitHub URL without any version control, hash verification, or content validation. An attacker could inject arbitrary rules into the fetched guidelines that would be interpreted and executed by the skill. This could lead to arbitrary code execution, data exfiltration, or malicious output injected into user reviews.

fix Implement strict content validation: (1) Pin to specific commit hashes, (2) Cryptographically verify fetched content using signatures, (3) Sandbox the execution of fetched guidelines, (4) Maintain a whitelist of allowed rules, or (5) Bundle guidelines directly with the skill and never fetch at runtime. Use a secure update mechanism if updates are necessary.

The skill description and multi-step narrative are carefully crafted to establish trust in the external GitHub source before delegating full control of rule interpretation and output formatting to the fetched guidelines. This is a social engineering pattern that primes users to accept whatever rules are fetched without scrutiny. Combined with the lack of version pinning, this suggests a possible intentional design for injecting malicious rules.

fix Remove the trust-building narrative. Clearly disclose that guidelines are fetched at runtime, show users the exact URL and commit being used, and display fetched content for review before applying rules. Implement a confirmation step where users can see and approve the guidelines before they are used to analyze their code.