codia-design-skills

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:47 AM UTC
• Version: 0.1.4

Overview

This appears to be a legitimate Codia design API skill pack, but its install path and credential handling deserve review before use.

Install only if you trust the Codia npm package, the skills installer, and the GitHub source at install time. Prefer pinned versions or a reviewed local bundle, avoid pasting API keys into chat or shell commands, and require explicit approval before enabling or changing auto-recharge.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: AGENT_INSTALL.md:18

Finding

Unpinned Executable Dependencies and Mutable Global Skill Installation

Content

View full analysis

Vulnerability Details

File Location: AGENT_INSTALL.md, lines 18–19, 54–69, and 78–85
Vulnerability Type: Unpinned third-party executable dependencies and mutable remote installation
Risk Level: High

Complete Code Snippet

markdown

Before running install commands, ask the user for permission to:

- Run `npm install -g @codia-ai/codia-design-cli`.
- Run `npx -y skills add https://github.com/codia-ai/codia-design-skills.git -g -y` to install the skill globally.

bash

npm install -g @codia-ai/codia-design-cli
codia-design --help

bash

npx -y @codia-ai/codia-design-cli --help

bash

npx -y skills add codia-ai/codia-design-skills -g -y

bash

npx -y skills add https://github.com/codia-ai/codia-design-skills.git -g -y

Equivalent unpinned global CLI installation instructions also occur in SKILL.md:29–33 and repeatedly in child skills, including skills/codia-design/SKILL.md:44–51.

Technical Analysis

The instructions execute npm packages and install agent instructions from a mutable Git repository without pinning an exact npm version, repository commit, or verified integrity digest. Consequently, the code executed during installation can differ from the code reviewed during this audit.

npm install -g gives package installation scripts and runtime code the permissions of the agent's operating-system account while modifying a global package location. Similarly, npx -y automatically resolves and executes a package without an interactive approval step. The skills package itself is also unpinned, and it installs content from the current state of a remote repository into global agent skill directories.

GitHub is a conventional public code host rather than a pastebin, and the documentation asks for user permission before installation. These safeguards reduce accidental execution but do not establish artifact integrity or prevent a later supply-chain compromise.

Attack Path

1. An attacker compromises ...[truncated 1312 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the runtime CLI to a reviewed exact version:

   bash

   npm install -g @codia-ai/codia-design-cli@0.1.4
   

   Replace the example version with the independently reviewed release.

2. Pin the Git repository to a full commit SHA rather than installing the mutable default branch.

3. Pin the skills installer package itself to an exact reviewed version instead of invoking an unversioned npx skills.

4. Verify npm provenance, publisher identity, and package integrity before installation. Publish expected package metadata or integrity hashes through a trusted channel.

5. Prefer a project-local dependency with a lockfile over global installation. Run it with restricted filesystem and network permissions where supported.

6. Remove -y from security-sensitive npx commands so package resolution and execution are not silently approved.

7. Download and inspect remote skill files before activating them. Display the resolved commit and changed files to the user.

8. Disable or review npm lifecycle scripts where practical, and perform installation in a sandbox that does not expose unrelated credentials or files.

T09 · Insecure Skill Coding Practices

Warning

• Location: AGENT_INSTALL.md:130

Finding

API Keys Are Passed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: AGENT_INSTALL.md, lines 130–136
Vulnerability Type: Sensitive information exposure through process arguments and command logging
Risk Level: Medium

Complete Code Snippet

markdown

If the user provides an API key through `CODIA_API_KEY`, bind it without printing the value:

```bash
codia-design auth set --api-key "$CODIA_API_KEY"

If the user provides an API key directly in chat, do not echo it back. Run the auth command using the provided value only.

text

The same argument-based authentication pattern appears in `SKILL.md:58–64` and the child skills' runtime/authentication sections, for example:

```bash
codia-design auth set --api-key api_key_xxx

Technical Analysis

The documentation correctly prohibits printing API keys and configuration-file contents. However, expanding a secret into the --api-key argument places the plaintext key in the new process's argument vector.

Depending on the operating system and execution environment, process arguments may be exposed through process-listing utilities, /proc interfaces, endpoint monitoring, shell tracing, agent tool logs, audit logs, crash reports, or command telemetry. If the command is copied or entered manually, shell history may also retain it.

Quoting "$CODIA_API_KEY" prevents shell word splitting but does not prevent process-argument disclosure. Likewise, using a placeholder in documentation does not make a real key safe when an agent substitutes it into the command.

Attack Path

1. A user supplies a Codia API key through the environment or chat.
2. The agent expands the secret into:

   bash

   codia-design auth set --api-key "<real-key>"
   

3. The key becomes visible in the CLI process's argument vector or retained command telemetry.
4. A local user, monitoring agent, log reader, or compromised process captures the argument before or after command completion.
5. The attacker reuses the key against the Codia Open API ...[truncated 542 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a CLI authentication method that reads the key from standard input without echoing it:

   bash

   printf '%s' "$CODIA_API_KEY" | codia-design auth set --api-key-stdin
   

2. Alternatively, accept a pre-opened file descriptor or integrate with the operating system's credential manager. Avoid secret-bearing command-line arguments.

3. Do not place directly supplied chat credentials into generated shell commands. Prefer the browser/device authorization flow already documented.

4. Disable shell tracing while handling credentials and ensure agent execution frameworks redact secrets from tool calls, logs, errors, and telemetry.

5. Ensure ~/.codia/design-skills/config.json is created with owner-only permissions, such as mode 0600 on Unix-like systems.

6. Rotate any key that may already have appeared in process logs, shell history, chat transcripts, or agent telemetry.

7. Use narrowly scoped and short-lived credentials where the Codia platform supports them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (77)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

md

olling behavior, or multi-step sequencing. Resolve paths relative to this root `SKILL.md`.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The install flow executes npx -y skills without pinning a version, which causes the latest package to be fetched and run at install time. In an agent-install context this is dangerous because a compromised upstream package, typo-squatted dependency, or breaking release could lead to arbitrary code execution on the user's machine during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This command again relies on unpinned npx -y skills, which executes remote package code without constraining the version. Because the file is explicitly instructing coding agents to perform installation steps, this materially increases supply-chain and remote code execution risk rather than being a merely theoretical concern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx -y @codia-ai/codia-design-cli --help without a pinned version allows the latest published CLI code to execute immediately. Even though the example is presented as a fallback, it still creates a direct supply-chain execution path in a privileged local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The skill installation step uses unpinned npx -y skills add ..., which executes code from npm and then installs additional content from a remote GitHub repository. Chaining an unpinned package runner with remote repository installation compounds supply-chain risk and can expose the host to arbitrary code execution or malicious skill persistence.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This alternate installation form still depends on unpinned npx -y skills, so the same remote-code-execution and supply-chain concerns apply. The fact that it is an officially documented path makes exploitation more scalable if the upstream package is compromised.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The document instructs global installation of a top-level skill pack that will persist into future agent sessions. Persistent globally discoverable skills expand the trust boundary across sessions, so a malicious or later-compromised skill could keep influencing agent behavior long after the initial install.

Content

Scanner excerpt · AGENT_INSTALL.md (reported line 90)May include surrounding context.

md

If `npx skills` is unavailable, stop and ask the user how they want to install local agent skills. The npm CLI package does not bundle skill files.

Do not pass `--full-depth` for normal installs. A normal install should create one top-level `codia-design-skills` skill pack.

## Step 4: Verify Skill Installation

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENT_INSTALL.md (reported line 105)May include surrounding context.

One or more supported agent skill directories should contain the root pack and its nested feature files. Common locations include:

text

~/.agents/skills/codia-design-skills/SKILL.md
~/.agents/skills/codia-design-skills/skills/codia-image-generate/SKILL.md
~/.codex/skills/codia-design-skills/SKILL.md
~/.claude/skills/codia-design-skills/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENT_INSTALL.md (reported line 107)May include surrounding context.

One or more supported agent skill directories should contain the root pack and its nested feature files. Common locations include:

text

~/.agents/skills/codia-design-skills/SKILL.md
~/.agents/skills/codia-design-skills/skills/codia-image-generate/SKILL.md
~/.codex/skills/codia-design-skills/SKILL.md
~/.claude/skills/codia-design-skills/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENT_INSTALL.md (reported line 108)May include surrounding context.

One or more supported agent skill directories should contain the root pack and its nested feature files. Common locations include:

text

~/.agents/skills/codia-design-skills/SKILL.md
~/.agents/skills/codia-design-skills/skills/codia-image-generate/SKILL.md
~/.codex/skills/codia-design-skills/SKILL.md
~/.claude/skills/codia-design-skills/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · AGENT_INSTALL.md (reported line 109)May include surrounding context.

One or more supported agent skill directories should contain the root pack and its nested feature files. Common locations include:

text

~/.agents/skills/codia-design-skills/SKILL.md
~/.agents/skills/codia-design-skills/skills/codia-image-generate/SKILL.md
~/.codex/skills/codia-design-skills/SKILL.md
~/.claude/skills/codia-design-skills/SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 3)May include surrounding context.

md

# Codia Design Skills

Codia Design Skills gives local AI agents a reliable way to call Codia Open API from normal project work. After installation, an agent can inspect screenshots, convert PDFs into design data, generate or edit images, remove backgrounds, create SVG assets, export PDFs to PPT, and check account usage through the local `codia-design` command.

This repository is for agent skills. The skill files teach Codex, Claude Code, Cursor, and other agents when to use Codia, which workflow to choose, and how to call the runtime safely. The runtime CLI is installed separately and performs the authenticated API requests on the user's machine.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 76% confidence

Finding

The README instructs users/agents to run npx -y skills add https://github.com/codia-ai/codia-design-skills.git -g -y without pinning the skills package version. That creates a real supply-chain risk: a future compromised or malicious skills release could be fetched and executed automatically during installation, and the agent-oriented context increases the chance this command is run with limited human scrutiny.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrase use Codia is very broad and likely to match normal user language, which can cause unintended activation of this skill and execution of external CLI/API workflows. In an agent environment, overbroad routing increases the chance of surprise tool use, unnecessary data transmission, or unintended account actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Repeating the same broad trigger phrase for a compatibility router creates ambiguous activation boundaries between skills. That ambiguity can make the agent invoke the wrong skill path or perform unintended external actions, especially when combined with auto-install/setup behavior described elsewhere in the README.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 80% confidence

Finding

The README recommends npx -y @codia-ai/codia-design-cli --help without a pinned version, which can cause execution of whatever package version is current at runtime. Because this is a CLI that handles authenticated API actions on the user's machine, an upstream package compromise could lead to credential theft or arbitrary local command abuse.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SECURITY.md (reported line 33)May include surrounding context.

md

- Run documented `codia-design` commands.
- Read user-provided local images, PDFs, and output JSON files needed for the task.
- Write result files only to paths requested by the user, CLI defaults, or documented output directories.
- Read Codia auth status from `~/.codia/design-skills/config.json`.

The skill should not run arbitrary project scripts, execute user-supplied binaries, or inspect unrelated project files as part of a Codia workflow.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documentation recommends invoking the CLI via npx -y @codia-ai/codia-design-cli without pinning an exact version. That allows whatever version is current in the package registry at execution time to run, creating a supply-chain risk if a malicious or compromised release is published later. In an agent skill context, this is more dangerous because users may copy the command verbatim and execute unreviewed code locally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description is extremely broad and covers many loosely related image, document, account, and billing tasks, which increases the chance the skill is invoked when a narrower or safer skill should have been selected. Overbroad activation expands the authority surface of the skill, potentially causing unintended authenticated CLI/API actions, file writes, or account operations in response to ambiguous user prompts.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md

| User intent | Read |
|---|---|
| Broad Codia setup, auth, account checks, or fallback routing | `skills/codia-design/SKILL.md` |
| Product launch packs, ecommerce listing assets, marketplace visuals | `skills/codia-product-assets/SKILL.md` |
| Campaign posters, launch visuals, social creative sets, multi-size adaptations | `skills/codia-campaign-assets/SKILL.md` |
| PDF/report/document to editable design data, PPTX deck, or both | `skills/codia-document-deck/SKILL.md` |

Static analysis

No suspicious patterns detected.