design-html
“Design finalization: generates production-quality Pretext-native HTML/CSS. (gstack)”
vendor
aipkg.jsonLICENSE.txtREADME.mdSKILL.mdSKILL.md.tmplvendor/pretext.js- 01SDI-295%HIGH
SKILL.md:39
detailhide
The skill executes arbitrary binaries from user-controlled paths (~/.claude/skills/gstack/bin/) without validation. These binaries could be replaced or compromised. The preamble runs gstack-update-check, gstack-config, gstack-repo-mode, gstack-telemetry-log and other tools without verifying their integrity, allowing arbitrary code execution if the ~/.claude directory is writable by other users or processes.
3738```bash39_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)40[ -n "$_UPD" ] && echo "$_UPD" || true41mkdir -p ~/.gstack/sessionsfix Require cryptographic verification (SHA256 signatures) of all binaries before execution. Pin binary versions in a lockfile. Use absolute paths with permission checks (verify ownership and 0755 permissions). Consider shipping critical preamble logic as part of Claude Code itself rather than external binaries.
- 02SDI-390%MEDIUM
SKILL.md:41
detailhide
The preamble writes to ~/.gstack/ and ~/.claude/ directories without explicit user consent or documentation. It creates session tracking files, telemetry logs, analytics JSON, and configuration state files. This violates the principle of least surprise—users invoking a design skill do not expect persistent surveillance infrastructure. The writes happen silently without user notification.
39_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)40[ -n "$_UPD" ] && echo "$_UPD" || true41mkdir -p ~/.gstack/sessions42touch ~/.gstack/sessions/"$PPID"43_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')fix Add explicit user consent before any telemetry or analytics writes. Display a prominent warning during first run explaining what data is collected and where it is stored. Require explicit opt-in via AskUserQuestion before writing to ~/.gstack/analytics/. Document all side effects in the skill manifest, not just in preamble comments.
- 03SDI-185%MEDIUM
SKILL.md:5
detailhide
The skill manifest describes only HTML/CSS generation (design-html), but the preamble implements a complete system for telemetry, analytics, configuration management, session tracking, artifact syncing, and feature discovery. This mismatch allows dangerous functionality to hide under an innocent description. Users think they're invoking a design tool but actually enable a persistent background system.
3preamble-tier: 24version: 1.0.05description: Design finalization: generates production-quality Pretext-native HTML/CSS. (gstack)6triggers:7 - build the designfix Split the preamble into two parts: (1) minimal skill-specific setup, (2) optional gstack framework initialization behind explicit user consent. Move all telemetry, analytics, and config management to a separate /gstack-init skill that users must explicitly invoke. Clearly document in the skill manifest what persistent changes will be made.
- 04SQP-280%MEDIUM
SKILL.md:70
detailhide
The skill silently enables analytics and telemetry without user warning. Lines 70-72 append to ~/.gstack/analytics/skill-usage.jsonl when $_TEL is not 'off', but users are not warned this happens. The telemetry prompt appears much later in the preamble and only if specific conditions are met. Many users will never see the consent prompt.
68echo "QUESTION_TUNING: $_QUESTION_TUNING"69mkdir -p ~/.gstack/analytics70if [ "$_TEL" != "off" ]; then71echo '{"skill":"design-html","ts":"'$(date -u +%Y-%m-%dT%H:%M:%SZ)'","repo":"'$(basename "$(git rev-parse --show-toplevel 2>/dev/null)" 2>/dev/null || echo "unknown")'"}' >> ~/.gstack/analytics/skill-usage.jsonl 2>/dev/null || true72fifix Add a prominent AskUserQuestion at preamble start before ANY analytics writes occur. Make telemetry opt-in, not opt-out. Clearly state what data is collected (skill name, duration, repo name) and where it is sent. Do not write analytics until the user has explicitly consented.
- 05SQP-285%MEDIUM
SKILL.md:38
detailhide
The preamble executes dozens of subprocess calls and file system operations without user warnings: git commands, file operations, directory creation, process tracking, and binary execution. Users who invoke /design-html have no way to know they're triggering this infrastructure. This violates transparency and creates surprise side effects.
36## Preamble (run first)3738```bash39_UPD=$(~/.claude/skills/gstack/bin/gstack-update-check 2>/dev/null || .claude/skills/gstack/bin/gstack-update-check 2>/dev/null || true)40[ -n "$_UPD" ] && echo "$_UPD" || truefix Add a warning at skill invocation start that explains: (1) session tracking files will be created, (2) telemetry may be sent, (3) git state will be queried, (4) external binaries will be executed. Require explicit user consent before running the preamble. Make preamble execution optional—allow users to skip infrastructure setup for a simpler execution.
- 06SSD-370%MEDIUM
SKILL.md.tmpl:266
detailhide
Secondary finding on same line: The skill allows users to make any text element contenteditable without explicit security warnings about the risks of capturing user keystrokes or sensitive data via MutationObserver. The lack of scoping (e.g., restricting contenteditable to specific UI regions) means users could inadvertently enable keystroke capture on password fields or private messages if the generated HTML is reused.
264- Breakpoint-specific adjustments at 375px, 768px, 1024px, 1440px265- ARIA attributes, heading hierarchy, focus-visible states266- `contenteditable` on text elements + MutationObserver to re-prepare + re-layout on edit267- ResizeObserver on containers to re-layout on resize268- `prefers-color-scheme` media query for dark modefix Add explicit security documentation section. Warn users: 'Do NOT use contenteditable on password fields, credit card inputs, or any sensitive data fields.' Add a code comment in generated HTML: <!-- WARNING: contenteditable enables keystroke monitoring. Remove this if user input should be private. --> Consider adding a flag to disable contenteditable entirely via DESIGN.md token: `contenteditable_enabled: false`