ClawHub
Back to skill

Security audit

Sloth D2C Skills

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent Figma-to-code purpose, but it needs review because it can install a global npm tool and let generated markdown drive edits to project files.

Install only if you are comfortable with an automated tool modifying your project from Figma-derived content. Prefer installing the sloth CLI yourself from a reviewed, pinned source, run it in a restricted or disposable workspace, provide Figma tokens carefully, and review all generated diffs before building or committing them.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:92
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 92
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: High

Vulnerable Code

bash
npm install -g sloth-d2c-mcp

Technical Analysis

The troubleshooting workflow instructs the agent to install sloth-d2c-mcp globally from the npm registry when the sloth command is unavailable. The dependency is installed without:

  • A fixed and reviewed version
  • A lockfile
  • An integrity hash
  • Publisher or source verification
  • Restrictions on npm lifecycle scripts
  • Explicit user approval immediately before installation

Because no version is specified, npm resolves the package version associated with the mutable registry tag at installation time. A compromised maintainer account, malicious package release, registry compromise, or ownership transfer could therefore alter the executable code obtained after this skill has already been reviewed.

Global npm installation may execute package lifecycle hooks such as preinstall, install, and postinstall. Those hooks execute with the permissions of the user running the agent.

Attack Path

  1. The sloth executable is absent from the environment.
  2. The agent follows the troubleshooting instruction in SKILL.md.
  3. The agent runs npm install -g sloth-d2c-mcp.
  4. npm resolves and downloads the current package release rather than a reviewed, immutable version.
  5. A malicious or compromised release executes code through an npm lifecycle hook or the installed CLI.
  6. The payload runs with the invoking user's privileges and can access resources available to that account.

Impact Assessment

Successful exploitation can result in arbitrary local code execution with the agent user's permissions. Depending on the environment, the package could read or modify source code, access user-readable credentials and configuration files, alter globally install ...[truncated 233 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a specific, reviewed version, such as sloth-d2c-mcp@X.Y.Z.
  • Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
  • Verify the package publisher, repository, release provenance, and registry integrity metadata.
  • Use an approved internal registry or vendored artifact where feasible.
  • Disable lifecycle scripts during installation when they are unnecessary, for example with --ignore-scripts.
  • Require explicit user confirmation before installing any package.
  • Run the tool in a restricted environment with minimal filesystem and credential access.
  • Periodically review and update the pinned version through a controlled dependency-update process.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:48
Finding

Potential Shell Command Injection Through Unvalidated CLI Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 48-56
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash
sloth d2c \
  --file-key <fileKey> \
  --node-id <nodeId> \
  [--framework <react|vue|ios-oc|ios-swift|kuikly|taro|uniapp|hippy>] \
  [--depth <n>] \
  [--local] \
  [--update] \
  --silent --json

Technical Analysis

The skill directs the agent to construct and execute a Bash command using values that originate from the user's request. Although the supported framework values are documented, the skill does not require strict validation of fileKey, nodeId, or depth, and it does not require a shell-safe argument-array invocation.

If an agent performs direct textual interpolation, shell metacharacters embedded in an argument can be interpreted by Bash instead of being passed literally to sloth. Relevant metacharacters include command separators, command substitutions, redirections, pipes, and newline characters.

Quoting alone is not a complete substitute for validation if the command is assembled dynamically or evaluated again. The safer design is to validate each parameter and invoke the process without a shell.

Attack Path

  1. An attacker supplies a crafted fileKey, nodeId, or optional argument containing shell syntax.
  2. The agent substitutes that value directly into the documented Bash command.
  3. Bash parses the injected metacharacters as executable shell syntax.
  4. The attacker's additional command executes with the same permissions as the agent.
  5. The injected command can access any filesystem paths, environment variables, credentials, or network resources available to the agent process.

Exploitation depends on the executing agent using unsafe textual interpolation rather than a shell-safe process API, but the skill currently provides no safeguards requiring the safe implementation.

Imp

...[truncated 478 chars]

Remediation
View remediation

Remediation Suggestions

  • Validate framework against the exact documented enumeration.
  • Validate depth as a bounded positive integer.
  • Define strict allowlist patterns for fileKey and nodeId based on their documented Figma formats.
  • Reject control characters, whitespace where unnecessary, shell metacharacters, and unexpected leading hyphens.
  • Invoke sloth through a process API that accepts an argument array and does not invoke a shell.
  • Do not use eval, dynamically generated shell scripts, or concatenated command strings.
  • If Bash is unavoidable, pass validated values as separately quoted positional arguments.
  • Add tests using malicious input containing command separators, substitutions, redirections, newlines, and option-injection prefixes.

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:70
Finding

Untrusted CLI-Generated Markdown Is Used as Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70-83
Vulnerability Type: Indirect prompt injection through generated instruction files
Risk Level: High

Relevant Instruction Flow

The relevant source instructions require parallel subagents to process the following generated files:

text
{chunksDir}/{index}.md
{chunksDir}/codeAggregation.md

The main agent is then instructed to read the following file as a prompt and write the resulting code into project files:

text
{chunksDir}/finalGenerate.md

Technical Analysis

The files under chunksDir are produced through the sloth d2c and Figma conversion path, rather than being immutable instructions packaged with the reviewed skill. Their contents are nevertheless treated as agent prompts.

This creates an instruction/data boundary violation. Design-derived content, a compromised CLI, or another component able to modify the generated Markdown can insert instructions that the agent may interpret as authoritative. The workflow does not require:

  • Separation of untrusted design data from trusted agent instructions
  • Schema validation of generated files
  • Detection or rejection of embedded tool-use directives
  • Restriction of final output paths
  • User review before project files are modified

The background agent defined in sloth-d2c-agent.md is read-only, which limits its direct impact. However, the final generation stage is performed by the main agent and explicitly writes output into project files. Consequently, malicious content can cross from an untrusted generated file into a write-capable execution context.

Attack Path

  1. An attacker places adversarial text in Figma content processed by the conversion pipeline, compromises the conversion service or CLI, or modifies files under chunksDir.
  2. The generated text appears in a chunk, aggregation file, or finalGenerate.md.
  3. A subagent or the main agent reads ...[truncated 1061 chars]
Remediation
View remediation

Remediation Suggestions

  • Treat all files produced by the CLI or derived from Figma as untrusted data, not authoritative instructions.
  • Keep behavioral instructions in a fixed, reviewed prompt packaged with the skill.
  • Parse generated data through a strict structured schema, such as validated JSON, rather than executing free-form Markdown as a prompt.
  • Delimit external content clearly and instruct the model that directives inside that content must never be followed.
  • Reject content containing tool-use requests, attempts to change system behavior, unrelated file operations, or requests to disclose secrets.
  • Restrict generated output to an explicit allowlist of workspace-relative paths and expected file extensions.
  • Resolve and verify destination paths to prevent path traversal or writes through symbolic links.
  • Require a human-readable diff and explicit user approval before applying generated changes.
  • Run static analysis, dependency checks, and secret scanning against generated code before it is built or committed.
  • Preserve the subagent's read-only configuration and apply equivalent least-privilege restrictions to the final generation stage.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill description is written as an instruction set entirely in Chinese and presents activation behavior without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
### 可选参数

| 参数      | 默认值  | 使用时机                                                                                                            |
| --------- | ------- | ------------------------------------------------------------------------------------------------------------------- |
| framework | 自动    | 用户明确指定目标框架时传入，取值：`react` / `vue` / `ios-oc` / `ios-swift` / `kuikly` / `taro` / `uniapp` / `hippy` |
| depth     | 自动    | 仅当用户显式要求限制节点树遍历深度时传入，否则不加                                                                  |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill directs the agent to generate final code and write it into project files, but it does not require a user-facing confirmation, preview, or explicit warning that files will be modified. In an automated agent context, this can lead to unintended overwrites, insertion of unsafe generated code, or modification of sensitive files in the workspace.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
## 错误排除

| 错误场景                     | 处理方式                                                                                               |
| ---------------------------- | ------------------------------------------------------------------------------------------------------ |
| `sloth: command not found`   | 执行 `sloth -v`：有版本号则提示配置 PATH；无版本号则执行 `npm install -g sloth-d2c-mcp` 安装           |
| CLI 退出码非 0 / `ok:false`  | 读取 JSON 中的 `error`/`message` 字段并展示给用户                                                      |

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to run npm install -g sloth-d2c-mcp when the CLI is missing, which performs system-wide software installation rather than limiting behavior to the stated design-to-code task. This expands host capabilities, changes the environment persistently, and could introduce supply-chain risk or unauthorized tool installation without explicit user approval.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and all operating instructions are written as mandatory Chinese-language directives, with no indication that the skill can adapt to the user's preferred language or locale. This creates a natural-language policy concern because it imposes a specific language without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.