Sloth D2C Skills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:06 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent Figma-to-code purpose, but it needs review because it can install a global npm tool and let generated markdown drive edits to project files.

Install only if you are comfortable with an automated tool modifying your project from Figma-derived content. Prefer installing the sloth CLI yourself from a reviewed, pinned source, run it in a restricted or disposable workspace, provide Figma tokens carefully, and review all generated diffs before building or committing them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:92
• Finding: Unpinned Global Installation of a Third-Party npm Package## Vulnerability Details **File Location**: `SKILL.md`, line 92 **Vulnerability Type**: Unverified and unpinned third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash npm install -g sloth-d2c-mcp ``` ### Technical Analysis The troubleshooting workflow instructs the agent to install `sloth-d2c-mcp` globally from the npm registry when the `sloth` command is unavailable. The dependency is installed without: - A fixed and reviewed version - A lockfile - An integrity hash - Publisher or source verification - Restrictions on npm lifecycle scripts - Explicit user approval immediately before installation Because no version is specified, npm resolves the package version associated with the mutable registry tag at installation time. A compromised maintainer account, malicious package release, registry compromise, or ownership transfer could therefore alter the executable code obtained after this skill has already been reviewed. Global npm installation may execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Those hooks execute with the permissions of the user running the agent. ### Attack Path 1. The `sloth` executable is absent from the environment. 2. The agent follows the troubleshooting instruction in `SKILL.md`. 3. The agent runs `npm install -g sloth-d2c-mcp`. 4. npm resolves and downloads the current package release rather than a reviewed, immutable version. 5. A malicious or compromised release executes code through an npm lifecycle hook or the installed CLI. 6. The payload runs with the invoking user's privileges and can access resources available to that account. ### Impact Assessment Successful exploitation can result in arbitrary local code execution with the agent user's permissions. Depending on the environment, the package could read or modify source code, access user-readable credentials and configuration files, alter globally install ...[truncated 233 chars]
• Remediation: ## Remediation Suggestions - Pin the dependency to a specific, reviewed version, such as `sloth-d2c-mcp@X.Y.Z`. - Prefer a project-local dependency governed by a committed lockfile instead of a global installation. - Verify the package publisher, repository, release provenance, and registry integrity metadata. - Use an approved internal registry or vendored artifact where feasible. - Disable lifecycle scripts during installation when they are unnecessary, for example with `--ignore-scripts`. - Require explicit user confirmation before installing any package. - Run the tool in a restricted environment with minimal filesystem and credential access. - Periodically review and update the pinned version through a controlled dependency-update process.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:48
• Finding: Potential Shell Command Injection Through Unvalidated CLI Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 48-56 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash sloth d2c \ --file-key <fileKey> \ --node-id <nodeId> \ [--framework <react|vue|ios-oc|ios-swift|kuikly|taro|uniapp|hippy>] \ [--depth <n>] \ [--local] \ [--update] \ --silent --json ``` ### Technical Analysis The skill directs the agent to construct and execute a Bash command using values that originate from the user's request. Although the supported framework values are documented, the skill does not require strict validation of `fileKey`, `nodeId`, or `depth`, and it does not require a shell-safe argument-array invocation. If an agent performs direct textual interpolation, shell metacharacters embedded in an argument can be interpreted by Bash instead of being passed literally to `sloth`. Relevant metacharacters include command separators, command substitutions, redirections, pipes, and newline characters. Quoting alone is not a complete substitute for validation if the command is assembled dynamically or evaluated again. The safer design is to validate each parameter and invoke the process without a shell. ### Attack Path 1. An attacker supplies a crafted `fileKey`, `nodeId`, or optional argument containing shell syntax. 2. The agent substitutes that value directly into the documented Bash command. 3. Bash parses the injected metacharacters as executable shell syntax. 4. The attacker's additional command executes with the same permissions as the agent. 5. The injected command can access any filesystem paths, environment variables, credentials, or network resources available to the agent process. Exploitation depends on the executing agent using unsafe textual interpolation rather than a shell-safe process API, but the skill currently provides no safeguards requiring the safe implementation. ### Imp ...[truncated 478 chars]
• Remediation: ## Remediation Suggestions - Validate `framework` against the exact documented enumeration. - Validate `depth` as a bounded positive integer. - Define strict allowlist patterns for `fileKey` and `nodeId` based on their documented Figma formats. - Reject control characters, whitespace where unnecessary, shell metacharacters, and unexpected leading hyphens. - Invoke `sloth` through a process API that accepts an argument array and does not invoke a shell. - Do not use `eval`, dynamically generated shell scripts, or concatenated command strings. - If Bash is unavoidable, pass validated values as separately quoted positional arguments. - Add tests using malicious input containing command separators, substitutions, redirections, newlines, and option-injection prefixes.

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:70
• Finding: Untrusted CLI-Generated Markdown Is Used as Agent Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 70-83 **Vulnerability Type**: Indirect prompt injection through generated instruction files **Risk Level**: High ### Relevant Instruction Flow The relevant source instructions require parallel subagents to process the following generated files: ```text {chunksDir}/{index}.md {chunksDir}/codeAggregation.md ``` The main agent is then instructed to read the following file as a prompt and write the resulting code into project files: ```text {chunksDir}/finalGenerate.md ``` ### Technical Analysis The files under `chunksDir` are produced through the `sloth d2c` and Figma conversion path, rather than being immutable instructions packaged with the reviewed skill. Their contents are nevertheless treated as agent prompts. This creates an instruction/data boundary violation. Design-derived content, a compromised CLI, or another component able to modify the generated Markdown can insert instructions that the agent may interpret as authoritative. The workflow does not require: - Separation of untrusted design data from trusted agent instructions - Schema validation of generated files - Detection or rejection of embedded tool-use directives - Restriction of final output paths - User review before project files are modified The background agent defined in `sloth-d2c-agent.md` is read-only, which limits its direct impact. However, the final generation stage is performed by the main agent and explicitly writes output into project files. Consequently, malicious content can cross from an untrusted generated file into a write-capable execution context. ### Attack Path 1. An attacker places adversarial text in Figma content processed by the conversion pipeline, compromises the conversion service or CLI, or modifies files under `chunksDir`. 2. The generated text appears in a chunk, aggregation file, or `finalGenerate.md`. 3. A subagent or the main agent reads ...[truncated 1061 chars]
• Remediation: ## Remediation Suggestions - Treat all files produced by the CLI or derived from Figma as untrusted data, not authoritative instructions. - Keep behavioral instructions in a fixed, reviewed prompt packaged with the skill. - Parse generated data through a strict structured schema, such as validated JSON, rather than executing free-form Markdown as a prompt. - Delimit external content clearly and instruct the model that directives inside that content must never be followed. - Reject content containing tool-use requests, attempts to change system behavior, unrelated file operations, or requests to disclose secrets. - Restrict generated output to an explicit allowlist of workspace-relative paths and expected file extensions. - Resolve and verify destination paths to prevent path traversal or writes through symbolic links. - Require a human-readable diff and explicit user approval before applying generated changes. - Run static analysis, dependency checks, and secret scanning against generated code before it is built or committed. - Preserve the subagent's read-only configuration and apply equivalent least-privilege restrictions to the final generation stage.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The skill description is written as an instruction set entirely in Chinese and presents activation behavior without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

### 可选参数

| 参数      | 默认值  | 使用时机                                                                                                            |
| --------- | ------- | ------------------------------------------------------------------------------------------------------------------- |
| framework | 自动    | 用户明确指定目标框架时传入，取值：`react` / `vue` / `ios-oc` / `ios-swift` / `kuikly` / `taro` / `uniapp` / `hippy` |
| depth     | 自动    | 仅当用户显式要求限制节点树遍历深度时传入，否则不加                                                                  |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill directs the agent to generate final code and write it into project files, but it does not require a user-facing confirmation, preview, or explicit warning that files will be modified. In an automated agent context, this can lead to unintended overwrites, insertion of unsafe generated code, or modification of sensitive files in the workspace.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## 错误排除

| 错误场景                     | 处理方式                                                                                               |
| ---------------------------- | ------------------------------------------------------------------------------------------------------ |
| `sloth: command not found`   | 执行 `sloth -v`：有版本号则提示配置 PATH；无版本号则执行 `npm install -g sloth-d2c-mcp` 安装           |
| CLI 退出码非 0 / `ok:false`  | 读取 JSON 中的 `error`/`message` 字段并展示给用户                                                      |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to run `npm install -g sloth-d2c-mcp` when the CLI is missing, which performs system-wide software installation rather than limiting behavior to the stated design-to-code task. This expands host capabilities, changes the environment persistently, and could introduce supply-chain risk or unauthorized tool installation without explicit user approval.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The manifest description and all operating instructions are written as mandatory Chinese-language directives, with no indication that the skill can adapt to the user's preferred language or locale. This creates a natural-language policy concern because it imposes a specific language without user opt-in or an explicit region-specific justification.

Static analysis

No suspicious patterns detected.