Security Audit
vercel-labs/agent-skills:skills/web-design-guidelines
github.com/vercel-labs/agent-skillsTrust Assessment
vercel-labs/agent-skills:skills/web-design-guidelines received a trust score of 85/100, placing it in the Mostly Trusted category. This skill has passed most security checks with only minor considerations noted.
SkillShield's automated analysis identified 1 finding: 0 critical, 1 high, 0 medium, and 0 low severity. Key findings include Dynamic Instruction Injection via External URL.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on August 1, 2026 (commit 7c180d90). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Dynamic Instruction Injection via External URL The skill fetches instructions and rules dynamically from an external, mutable URL ('https://raw.githubusercontent.com/vercel-labs/web-interface-guidelines/main/command.md') at runtime. Because the fetched content is treated as instructions for the LLM, any compromise or unauthorized modification of the remote repository could result in arbitrary prompt injection, potentially leading to data exfiltration or other malicious behaviors. Embed the guidelines directly within the skill package, or fetch them from a static, immutable source (such as a specific commit hash) and sanitize/validate the content before presenting it to the LLM. | LLM | SKILL.md:15 |
Scan History
Embed Code
[](https://skillshield.io/report/38d87b93358db44b)
Powered by SkillShield