Is nextlevelbuilder/ui-ux-pro-max-skill safe?
https://github.com/nextlevelbuilder/ui-ux-pro-max-skill
nextlevelbuilder/ui-ux-pro-max-skill is a legitimate, actively maintained UI/UX design intelligence tool (ClaudeKit) with substantial functionality spanning design systems, logo generation, CIP mockups, and slide creation. No malicious code, hidden exfiltration logic, or prompt injection patterns were found in the skill content itself, and all canary honeypot files remain intact. However, the bundled stack configuration grants agents blanket read access to all of /home/, setup scripts execute unpinned npm packages via npx --yes, the skill requires Gemini API keys and transmits user brand data to Google, and the design-review subagent combines Playwright with Bash tool access in a proactive-activation pattern — together these represent a meaningful but not malicious elevation of capability that users should evaluate before deployment.
Category Scores
Findings (12)
HIGH Blanket home-directory read permission in stack settings -15 ▶
The file stack/.claude/settings.json contains 'Read(//home/**)' in its permissions.allow list. Any project that copies or loads this stack configuration into Claude Code grants the agent unrestricted read access to every file under /home/, including .ssh/id_rsa, .aws/credentials, .env, .npmrc, and similar credential stores. Because the permission is declared in a settings file that ships with the skill rather than being requested per-operation, users may not realize they are granting this scope.
HIGH Unpinned npm package auto-executed via npx --yes -20 ▶
stack/scripts/setup.sh runs 'npx --yes ui-ux-pro-max-cli init --ai claude', which silently downloads and executes the latest version of ui-ux-pro-max-cli from the npm registry without version pinning or integrity verification. If the npm package is compromised (account takeover, dependency confusion, malicious publish), arbitrary code would execute on the user's machine during setup.
MEDIUM Script self-repair instruction creates code-injection surface -10 ▶
The design SKILL.md includes the instruction 'IMPORTANT: When scripts fail, try to fix them directly.' This instructs the agent to autonomously rewrite Python scripts within the skill directory when they encounter errors. A maliciously crafted error message returned by a generate.py call (e.g., from a manipulated Gemini API response) could guide the agent to introduce back-doors or exfiltration code into the scripts it 'fixes'.
MEDIUM User project data transmitted to Google Gemini API -12 ▶
The design, CIP, and icon generation scripts call Google Gemini APIs (gemini-2.5-flash-image, gemini-3-pro-image-preview, gemini-3.1-pro-preview) with user-supplied brand names, logo file paths, industry context, and design prompts. The GEMINI_API_KEY is set as a plain environment variable. Users' brand and project information is sent to Google with no anonymization or data-minimization guidance.
MEDIUM Playwright + Bash in design-review subagent grants full browser+shell access -12 ▶
The .claude/agents/design-review.md subagent declares 'tools: mcp__playwright, mcp__chrome-devtools, Read, Grep, Glob, Bash'. This combination allows the agent to open URLs in a real browser (including internal services), read the filesystem, and execute arbitrary shell commands. The agent is designed to run proactively 'after any front-end change', meaning it activates without explicit user invocation.
MEDIUM System package installation instructed as part of setup -6 ▶
SKILL.md instructs users to run 'pip install google-genai pillow' as part of normal skill setup. This modifies the user's Python environment with unpinned package versions. The google-genai package is a Google API client that makes outbound HTTPS calls; pillow is an image-processing library with a history of critical CVEs in older versions.
MEDIUM Multi-skill chaining expands capability scope without per-step user consent -15 ▶
The Social Photos workflow instructs the agent to sequentially invoke /ckm:brand, /ckm:design-system, and randomly /ck:ui-ux-pro-max or /ck:frontend-design. Each sub-skill invocation may introduce its own permissions and behaviors. The user's single 'create social photos' request can result in three or more sub-agent activations with different tool grants, none of which the user explicitly authorized individually.
LOW Pexels/Unsplash API calls from fetch-background.py transmit user context -5 ▶
The design-system skill's fetch-background.py calls Pexels or Unsplash APIs with search queries derived from the user's slide content (e.g., project name, slide type, industry). This sends project metadata to third-party image services. API keys for these services would also be present in the environment.
LOW External CDN dependency in generated slide HTML -4 ▶
The design-system SKILL.md requires all slides to load Chart.js from an external CDN (https://cdn.jsdelivr.net/npm/[email protected]/dist/chart.umd.min.js). Generated HTML files delivered to users will execute code from this CDN. A CDN compromise or version upgrade could introduce malicious code into every presentation generated by the skill.
LOW Pre-existing Ubuntu/Canonical connection active during install -10 ▶
Network monitoring shows an established connection to 185.125.190.49:443 (Canonical/Ubuntu infrastructure) at the time of install monitoring. While not initiated by the skill, this pre-existing connection represents an active outbound channel that was present during the entire audit window.
INFO Sensitive canary files read pre-clone — consistent with audit infrastructure baselining 0 ▶
Files .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json were opened and read at 10:39:26, approximately 5–6 seconds before the git clone began at 10:39:32. Access coincides with audit monitoring startup (ss, sudo, tcpdump). All canary files remain intact. No outbound connections carrying credential payloads were observed. Assessment: audit infrastructure baselining, not skill-initiated exfiltration.
INFO Skill targets 20+ AI platforms with platform-specific SKILL.md templates 0 ▶
The repo includes platform-specific JSON templates for Claude, Cursor, Windsurf, Copilot, Kiro, Roocode, Gemini CLI, and 14 others. Each platform template configures the skill's frontmatter and folder structure differently. While this is legitimate multi-platform distribution, the breadth of targeting indicates the skill is designed to embed into many agent environments.