T08 · Insecure Dependencies
Warning
- Location
SKILL.md:19- Finding
Unpinned Scaffolding Package Executes Mutable Code from the npm Registry
- Content
View full analysis
- Remediation
View remediation
Security audit
Webflow Designer Extension
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent Webflow Designer Extension documentation helper with some normal developer risks but no hidden or unrelated behavior.
Installers should treat this as a developer documentation skill: prefer pinned package versions instead of @latest, use test sites first, review any generated extension before granting Webflow permissions, and handle ID tokens and site-wide mutation examples carefully.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is focused on Webflow Designer Extension development inside the Webflow Designer environment, including API interaction, UI design patterns, and extension-specific debugging/modification tasks. The supplied code does not implement any Webflow-related functionality, does not run inside Webflow Designer, and does not manipulate elements, styles, pages, components, variables, or assets through Webflow APIs. Instead, it is a local CLI tool for searching Markdown reference files under a references directory. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **[Designer APIs Reference](references/designer-apis-reference.md)** — all `webflow.*` methods in one table
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **[Designer APIs Reference](references/designer-apis-reference.md)** — all `webflow.*` methods in one table
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill instructs use of a local search script that reads reference Markdown files, but the manifest does not declare any tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and can let an agent access local files without an explicit user-visible declaration of that capability.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
Using
npx create-webflow-extension@latestpulls and executes whatever package version is current at runtime, creating a supply-chain risk. If the upstream package or dependency chain is compromised, users of the skill may execute attacker-controlled code on their machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The CLI reference again recommends
npx create-webflow-extension@latest, which causes execution of an unpinned remote package version. Repeating this pattern increases the chance that users follow unsafe installation guidance and are exposed to a package takeover or malicious update.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This example fetches content from an external domain and uploads it into the user's Webflow project without any explicit disclosure, confirmation, or discussion of data transfer and third-party dependency risks. In a designer extension context, this can normalize silent outbound network access and remote content ingestion, which is risky because external resources may be unavailable, swapped, tracked, or unsuitable for the target site.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This example creates a new page, changes SEO metadata, sets an external Open Graph image URL, switches the active page, and inserts content, all without an explicit warning that it performs persistent site modifications. In the context of a Webflow Designer Extension skill, these are powerful actions that could unintentionally alter production content or metadata if copied blindly by users or agents.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The reference exposes the existence of
webflow.getIdToken()and describes it as returning a JWT, but provides no warning that this is a sensitive credential that must not be logged, embedded in client-visible output, or sent to untrusted destinations. In an extension-building skill, that omission increases the chance developers will misuse the token in insecure patterns, leading to credential leakage or unauthorized API access within the token's validity window.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown reference includes a direct
element.remove()example that deletes the selected element, but the surrounding description provides no warning that the action is destructive or irreversible. Under the markdown-specific warning criterion, documentation should disclose behaviors that can affect user data or page integrity.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file documents obtaining a user JWT via
getIdToken()and sending it to a backend, but it does not warn users that identity data will be transmitted off-platform. For markdown files, omitting privacy-impacting warnings about authentication or data-sharing behavior qualifies as a missing user warning.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md const idToken = await webflow.getIdToken(); // Send to your backend const response = await fetch('https://your-backend.com/auth', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ idToken })
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
typescript // On your backend - resolve with Webflow API const resolved = await fetch('https://api.webflow.com/token/resolve', { method: 'POST', headers: { 'Authorization': `Bearer ${accessToken}`,
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
typescript // On your backend - resolve with Webflow API const resolved = await fetch('https://api.webflow.com/token/resolve', { method: 'POST', headers: { 'Authorization': `Bearer ${accessToken}`,
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The bulk update example iterates over all pages and changes search and Open Graph metadata site-wide without any confirmation, scoping guard, or warning about irreversible broad content changes. In a Designer Extension context, users may copy this example into production tooling and unintentionally modify many pages at once, causing SEO, search-result, and social-sharing metadata drift across the site.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example fetches content from an external URL and immediately re-uploads it into Webflow assets without any warning or validation guidance. In this skill context, developers may copy the pattern into production extensions, which can cause ingestion of untrusted third-party content, unexpected licensing/privacy issues, or abuse of the site as a relay for remote files.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents that changes to a component definition propagate to all instances, which can affect many elements at once. Under the missing-user-warnings rule for markdown, this behavior should be called out as a caution because it may impact user data or site integrity if performed unintentionally.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The example shows entering a component context and appending a new child element, which changes the shared definition for all instances. Although success/error notifications are present, the markdown does not warn readers that this operation can broadly alter existing content and layout across the project.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The frontmatter description says this is a quick reference for all Webflow Designer API methods across elements, styles, components, pages, variables, assets, and utilities. However, the document also includes app/extension-specific capabilities such as site metadata, launch context, app connections, element snapshots, subscriptions, and user ID token retrieval, which go beyond the listed Designer API categories and broaden the scope of what the file claims to cover.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The file describes capturing a base64 PNG snapshot of a selected element and assigning it for display, but does not include any warning about the sensitivity of captured visual content. In markdown skill documentation, snapshotting user/site content can affect privacy or data handling and should be disclosed.
- Content