Security · Case study
How we reviewed UI/UX Pro Max before installation.
A layered review of one UI/UX skill and its six bundled add-ons: exact-artifact static scanning, OWASP prompt-injection triage, and a scoped semantic second opinion through OpenRouter.
01
Review the complete target, not the headline skill
UI/UX Pro Max is presented as design intelligence for coding agents. Its published CLI artifact contained the core design catalog and six companion skills: banner-design, brand, design, design-system, slides, and ui-styling.
The review staged the exact published package instead of installing it. That matters because a default installer can widen the trust boundary from one expected skill to an entire bundle of instructions, scripts, dependencies, and optional external calls.
Evidence applies to the artifact that was actually reviewed. It does not transfer automatically to a moving repository branch, a future package release, or a differently scoped install command.
02
Screen every bundled skill before anything runs
We upgraded NVIDIA SkillSpector from its official upstream, then ran its static analyzers against each add-on directory. The scanner inspected the complete staged directories; its model-based semantic mode was intentionally not used for this first pass.
| Bundled skill | Static result | What human review found |
|---|---|---|
banner-design | 0 · Low | No static findings; its overlap with the larger design workflow still limited its value. |
brand | 37 · Medium | Most alerts were context-dependent; undeclared permissions remained a governance gap. |
design | 83 · Critical | The material concern: broad dotenv loading alongside external Gemini calls, plus active-output risks. |
design-system | 27 · Medium | Fixed argument-array process calls were not shell injection; unpinned package commands were still a supply-chain concern. |
slides | 5 · Low | Its only alert was an ordinary HTML comment; generated HTML still needs normal output controls. |
ui-styling | 43 · Medium | Documentation and test noise inflated the count; mutable package execution and dependency hygiene remained relevant. |
The high score for design was not treated as a verdict by itself. It prompted line-level investigation, deduplication, and comparison with the capability the skill actually claimed to provide.
03
Use OWASP patterns as triage—not clearance
The OWASP LLM Prompt Injection Prevention Cheat Sheet explains why natural-language instructions and data need clear separation. We used its example direct-injection expressions as a deterministic first check:
ignore\s+(all\s+)?previous\s+instructions?you\s+are\s+now\s+(in\s+)?developer\s+modesystem\s+overridereveal\s+prompt
None of the six directories matched those four expressions. That result is useful, but deliberately narrow. OWASP also covers indirect injections in code comments, documentation, web content, images, and other material an agent may process; it calls out persistence, data exfiltration, tool misuse, and context poisoning as separate risks.
Broad fuzzy keywords created predictable false positives: “design system,” CSS overrides, Delete buttons, and file-ignore options. The lesson is simple: pattern checks identify places to inspect. They do not prove that a skill is safe, malicious, or ready to install.
The core skill can persist project design Markdown that later sessions may read as authoritative. Treat those files as untrusted project data on every read; do not allow them to override higher-level agent policy or human-approved design decisions.
04
Add a scoped semantic review
Static analysis can flag a process call, a credential reference, or an HTML comment without knowing whether the surrounding behavior is dangerous. We therefore sent a structured evidence summary to Claude Fable 5 through OpenRouter, using High reasoning effort and a pinned provider path.
The model reviewed a complete findings summary: the target scope, static results, line-level triage, OWASP outcomes, known historical issues, effectiveness observations, and the candidate adoption choices. It did not receive the raw full artifact, raw scanner reports, secrets, or local environment information. This was an independent judgment of the supplied evidence—not a second full code audit.
Its recommendation aligned with the human triage: retain the existing design authorities, use the UI/UX Pro Max core only as optional ideation if ever adopted, and avoid the umbrelladesign skill and ui-styling bundle component.
05
Interpret findings, not scores
Several scanner alerts were correct in category but not in impact. Fixed argument-array process invocations were not the same as demonstrated shell injection; ordinary HTML comments were not hidden instructions; and license or test-file matches were not runtime agency.
The review did identify material risk. Three scripts in the bundled design skill searched project and shared Claude dotenv locations before initializing Gemini clients. The code did not demonstrate transmission of unrelated secrets, but it unnecessarily crossed a shared credential boundary and paired that access with external calls. Unpinned npx commands and model-generated active SVG output were additional reasons not to install that component as-is.
- Record the exact artifact, version, commit, and integrity information before review.
- Read every report at file and line level; merge duplicate alerts before estimating severity.
- Separate a genuine capability from a demonstrated exploit path and from a false positive.
- Compare the residual risk with the marginal value over skills already trusted in the workflow.
06
Make a constrained decision—and keep usefulness separate
The outcome was no installation. The default seven-skill CLI bundle was not accepted. If the core catalog is ever needed, the safer path is to vendor only the exact, reviewed core directory; pin it; disable automatic updates; apply least-privilege process and network controls; and rescan every update.
The next evaluation is a usefulness experiment, not a security approval: use OpenRouter to send additional design questions to Kimi K3 and compare the answers with the existingfrontend-design and Impeccable workflows. Those prompts should avoid sensitive project data, treat model output as untrusted design input, and never cause an agent-skill installation on their own.
A security review can recommend “not yet” while still leaving a clean path to test the underlying design question.