registry / frontend-standard-skills / 1.0.0

frontend-standard-skills@1.0.0

Installable AI skills and enforceable rule files that make Claude Code, Cursor, and other AI coding tools produce accessible, performant (Core Web Vitals-optimized), and consistent frontend code across HTML/CSS, React, Next.js, Nuxt, Astro, Angular, Vue.j

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `npx frontend-standard-skills add <stack>` with an optional `--dir`.

Impact

Can influence coding-agent behavior within the user-selected project.

Mechanism

Copies bundled skills and writes marked rule sections to project AI-agent configuration files.

Rationale

The scanner's lifecycle finding is a false positive for blocking: the only install hook prints text. The explicit project-level agent-config mutation warrants a warning under policy, not a malicious verdict.

Evidence

package.jsonbin/cli.jsskills/react/assets/RULES.mdskills/core-standards/assets/RULES.md.claude-plugin/marketplace.jsonskills/<stack>/<targetDir>/.claude/skills/<stack>/<targetDir>/.cursor/rules/<stack>-frontend-standards.mdc<targetDir>/CLAUDE.md<targetDir>/AGENTS.md

Decision evidence

public snapshot

AI called this Suspicious at 94.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/cli.js` explicitly writes AI-tool configuration into a caller-selected project directory.
`add` defaults to all targets, including `.claude`, `.cursor`, `CLAUDE.md`, and `AGENTS.md`.
`package.json` has a `postinstall` hook, though it only prints a message.

Evidence against

`postinstall` executes only `console.log`; it performs no file mutation or network access.
`bin/cli.js` uses only `fs` and `path`; no shell, child process, eval, dynamic loading, or network client is present.
Config writes require the explicit `npx frontend-standard-skills add ...` command.
Injected skill/rule content is frontend accessibility, performance, and code-quality guidance; no credential harvesting or prompt-control instructions found.

Behavioral surface

Source

EnvironmentVarsFilesystem

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 10.3 KB of source

Source & flagged code

2 flagged

package.jsonView file

Lines 32-58json

32 },

33 "license": "MIT",

34 "author": "Abayomi John Olatunji",

35 "type": "commonjs",

36 "bin": {

37 "frontend-standard-skills": "bin/cli.js",

38 "fss": "bin/cli.js"

39 },

40 "files": [

41 "bin/",

42 "skills/",

43 ".claude-plugin/",

44 "README.md",

45 "LICENSE"

46 ],

47 "engines": {

48 "node": ">=16.0.0"

49 },

50 "scripts": {

51 "list": "node bin/cli.js list",

52 "postinstall": "node -e \"console.log('\\n✔ frontend-standard-skills installed. Run: npx frontend-standard-skills list\\n')\" || true"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L52

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

53 },

54 "publishConfig": {

55 "access": "public"

56 }

57}

58

Source & flagged code

2 flagged · loading source

package.jsonView file

•scripts.postinstall = node -e "console.log('\n✔ frontend-standard-skills installed. Run: npx frontend-standard-skills list\n')" || true

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg

•scripts.postinstall = node -e "console.log('\n✔ frontend-standard-skills installed. Run: npx frontend-standard-skills list\n')" || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

Findings

1 Critical1 High1 Medium2 Low

CriticalRed Install Lifecycle Scriptpackage.json

HighInstall Time Lifecycle Scriptspackage.json

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LPM CLI

Source & flagged code

2 flagged

package.jsonView file

Lines 32-58json

32 },

33 "license": "MIT",

34 "author": "Abayomi John Olatunji",

35 "type": "commonjs",

36 "bin": {

37 "frontend-standard-skills": "bin/cli.js",

38 "fss": "bin/cli.js"

39 },

40 "files": [

41 "bin/",

42 "skills/",

43 ".claude-plugin/",

44 "README.md",

45 "LICENSE"

46 ],

47 "engines": {

48 "node": ">=16.0.0"

49 },

50 "scripts": {

51 "list": "node bin/cli.js list",

52 "postinstall": "node -e \"console.log('\\n✔ frontend-standard-skills installed. Run: npx frontend-standard-skills list\\n')\" || true"

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L52

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L52

53 },

54 "publishConfig": {

55 "access": "public"

56 }

57}

58