Is frontend-design safe?
https://clawhub.ai/steipete/frontend-design
This skill is a benign frontend design prompt guide containing only markdown instructions and metadata. It contains no executable code, no data access patterns, no external URLs, and no prompt injection attempts. The skill's strong directive language is scoped entirely to aesthetic design choices and poses no security risk. All monitoring signals are clean.
Category Scores
Findings (3)
LOW Strong directive language in skill prompt -12 ▶
The skill uses emphatic directives like 'CRITICAL', 'NEVER', 'IMPORTANT' and motivational phrasing ('Don't hold back') that strongly shape agent behavior. While scoped to frontend aesthetics and not malicious, this could cause the agent to produce more elaborate code than a user expects for simple requests.
INFO Host agent runtime reads sensitive files during startup -5 ▶
The filesystem monitoring captured the host OpenClaw agent runtime reading .env, .aws/credentials, .profile, and .bashrc during its own initialization sequence. These reads are attributable to the agent platform, not the skill under test, and occur before skill installation completes.
INFO Generated code may include external CDN references -10 ▶
The skill encourages use of distinctive, non-standard fonts which in practice means the agent will generate code referencing Google Fonts or other font CDNs. This is standard web development practice but users should be aware that generated HTML will contain external resource links.