Skill

bootstrap-release

skill:twbs/bootstrap#bootstrap-release

Cuts a Bootstrap release from version preparation through npm, GitHub, NuGet, and documentation deployment. Use when a maintainer asks to release, publish, or ship Bootstrap, including prereleases such as v6.0.0-alpha.1.

SkillsMP

Verdict

Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:12 UTC at 05331e1

findings

medium

highest severity

threat classes

990

files scanned

342/342

checks satisfied

package advisories

Why this verdict

suspicious: finding skill:.cursor/skills/bootstrap-release:dist/js/bootstrap.bundle.min.js:6:SUPPLY
suspicious: finding skill:.cursor/skills/bootstrap-release:dist/js/bootstrap.bundle.min.js:8:HIJACK
suspicious: finding skill:.cursor/skills/bootstrap-release:dist/js/bootstrap.bundle.min.js:8:SUPPLY

Security findings 3

Supply chain

mediumContextual risklow confidence

The distribution file labeled Bootstrap v6.0.0-alpha.1 carries a provenance banner attributing its content to the unrelated third-party library vanilla-calendar-pro v3.4.0, indicating code beyond the declared Bootstrap bundle shipped under Bootstrap's trusted name.

dist/js/bootstrap.bundle.min.js:6

/*! name: vanilla-calendar-pro v3.4.0 | url: https://github.com/uvarov-frontend/vanilla-calendar-pro */

vector:code

Counter-argument considered

The strongest case against F1 is that an in-file vendor banner is normal bundler attribution, but no cited evidence shows the claim false or invokes a carve-out: the skill ships a dist bundle self-labeled Bootstrap whose code provably carries vanilla-calendar-pro v3.4.0 provenance with no declared claim covering vendored third-party code, and the vendored calendar code flows into the bundle's exported public API, so the contextual supply-chain flag stands.

Agent hijacking

mediumContextual risklow confidence

The minified bundle's string constant P embeds two zero-width space characters (U+200B) inside a user-facing error message about «locale.weekdays»/«locale.months», an invisible-character anomaly in shipped code with no functional role, no decodable payload, and no connected harmful behavior chain.

dist/js/bootstrap.bundle.min.js:8

required number of values ⟦U+200B⟧⟦U+200B⟧for «locale.weekdays»

Decoded

You specified an incorrect language label or did not specify the required number of values for «locale.weekdays» or «locale.months».

conceal:unicodevector:code

Counter-argument considered

Two zero-width spaces are verifiably embedded in the shipped bundle's string constant P, an undeclared concealment that per the concealment rule cannot be refuted on the grounds that the hidden text looks harmless; however, no shown code decodes, branches on, or otherwise consumes the characters — the constant is only thrown as an error message — so the chain gate fails by absence and the finding survives as a low-severity concealment anomaly rather than being refuted.

Supply chain

mediumContextual risklow confidence

The skill ships a minified JavaScript bundle containing two U+200B zero-width space characters embedded in a vanilla-calendar locale error string whose provenance (upstream content versus skill-side insertion into the shipped artifact) is unestablished.

dist/js/bootstrap.bundle.min.js:8

⟦U+200B⟧⟦U+200B⟧for «locale.weekdays» or «locale.months».

conceal:unicodevector:code

Counter-argument considered

The two U+200B characters are verified present in the shipped dist bundle at the claimed location, and per policy concealment of hidden Unicode in an artifact that the release skill publishes to npm/GitHub is itself the harm, which no declared claim in the target description covers. The chain gate fails only by absence (the ZWSPs sit in an inert error-message string with no instruction or source-to-sink flow), and an absence claim cannot refute, so the contextual-risk finding stands as stated.

Open questions 7

What the analysis could not settle from the code alone.

A detector reports two U+200B zero-width characters at dist/js/bootstrap.bundle.min.js line 8 outside emoji/joining-script context, but the served decoded view of lines 1-9 does not render them; the carrier text and purpose of these invisible characters cannot be confirmed from this pass, so concealed instructions or a hidden payload cannot be ruled out.

Agent hijacking

The release skill ships a full minified Bootstrap/vanilla-calendar dist bundle under dist/js; it is not settled from the shown units whether this is an intended copy of the release payload the skill operates on or an undeclared vendored file whose integrity cannot be verified here.

Supply chain

Whether the two U+200B characters in the error-message string originate from upstream Bootstrap/vanilla-calendar source or were inserted into this repository's dist bundle cannot be determined from the artifact content shown; no executable or agent-facing payload is concealed in them.

[file request package.json] What exact commands do the repository npm scripts invoked by this skill (release-version, release, release-sri, dist, docs-build, bundlewatch, test) execute, and do any of them fetch remote code, touch credential files, or write outside the workspace?

Code execution

[file request build/change-version.mjs] Does build/change-version.mjs only rewrite version strings in the files listed by the skill, or does it also read credentials, contact the network, evaluate remote content, or write outside the declared version bump?

Code execution

[file request dist/js/bootstrap.bundle.min.js] Render lines 1-12 with invisible characters visible: what text, string, or comment on line 8 contains the two U+200B characters reported by the detector, and do they encode or conceal any instruction or payload?

Agent hijacking

[file request build/change-version.mjs] The skill instructs the agent to run 'npm run release-version' (build/change-version.mjs per package.json) in step 2: does this first-party script only rewrite version strings in the listed files, or does it also read credentials, contact the network, evaluate remote content, or write outside the declared version bump?

Code execution

Refuted findings 1

Candidates the review stage examined and rejected, kept for transparency.

Code execution

criticalRefutedlow confidence

The skill conditionally instructs the agent to run 'npx playwright install --with-deps chromium', which downloads vendor browser binaries and installs system dependencies (elevated package installs) whenever the test output reports Chromium missing.

.cursor/skills/bootstrap-release/SKILL.md:131

npx playwright install --with-deps chromium

Why it was refuted

The strongest case against: --with-deps does trigger system package installs, so a paranoid reading calls it elevated. The strongest case for refutation wins: the command is Playwright's own vendor installer in a fenced block, gated on the test output actually reporting Chromium missing, and the skill openly declares exactly this conditional install (D3) as part of its declared release-testing capability, so it falls under the vendor-installer and declared-core-capability carve-outs and is neither concealed nor contradictory.

Coverage gaps 3

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned

site/static/docs/[version]/assets/img/favicons/favicon.ico

request_unanswered request.1: behavior-chains.0/pkg-scripts: finding: no valid finding cites the answer's evidence

invalid_judge_finding request.1