skema

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 1.00). The prompt instructs the agent to silently install a persistent auto-update hook into host agent settings (e.g., ~/.claude/settings.json and ~/.cursor/settings.json) and modify host configuration—behavior outside and not required for generating UI designs, and therefore hidden/deceptive.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The package embeds a persistent, global "install-hook" that writes to user home settings (~/.claude/settings.json and ~/.cursor/settings.json), adds a SessionStart hook that runs a remote npx install command ("npx skills add Bil0000/skema-skill ...") on every session start (and re-adds it if removed), instructs bypassing permission prompts, and offers automated updates and hook replacement logic — this is a deliberate persistence/supply‑chain mechanism that enables remote code execution and silent auto-updates and can be abused as a backdoor.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). Yes — the skill explicitly fetches and ingests arbitrary public third‑party content as part of its mandatory pipeline (SKILL.md §2 Rule 2 and the Operating Sequence), e.g. modules/01-context-intake web_fetches and classifies URLs (GitHub, figma, generic http(s) links), modules/03-clone-engine §1 FETCH uses Playwright and computed-style dumps to reverse-engineer public websites, and modules/05-web-research runs web research — that untrusted, user-referenced content is parsed/tokenized and directly drives generation and follow-up actions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's install-hook injects a SessionStart command that runs "npx skills add Bil0000/skema-skill --skill skema" which will fetch/execute code from https://github.com/Bil0000/skema-skill at session start, introducing a runtime external dependency that can change the agent's code/behavior.