Design To Code

• Outcome: Pass
• Latest audit: Jun 26, 2026 · 2:13 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed design-to-code workflow that can generate broad full-stack app scaffolding, but I found no hidden execution, credential theft, exfiltration, or deceptive install behavior.

Install this if you want an agent to turn designs into runnable apps, including possible backend and database scaffolding. Before using generated code in real projects, review secrets handling, access control, payment/webhook logic, upload restrictions, logging, and any Figma or AI-provider data sharing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The publishing guide advertises capabilities beyond the stated skill scope by claiming automatic database schema and RESTful API generation. This can mislead users and reviewers about what the skill does, weakening trust boundaries and potentially causing the skill to be approved, installed, or invoked under false assumptions about its behavior and required review scope.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The quick-copy section repeats broader full-stack claims, including backend API and schema generation, which are absent from the manifest description. Repetition increases the chance that inaccurate capability claims are propagated into marketplace metadata, causing downstream users to rely on misleading descriptions and reducing the effectiveness of scope-based security review.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger conditions are broad natural-language phrases such as '帮我实现这个页面' and '帮我实现这个页面', which can cause the skill to activate on ambiguous requests that do not clearly imply consent to scaffold projects, generate code, or prepare runnable apps. In this skill's context, accidental activation is more dangerous because later steps include file creation, dependency setup, and potentially full-stack scaffolding with persistence-oriented defaults.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to create runnable local project structures and, elsewhere, initialize databases and perform CRUD-oriented full-stack setup, but it does not clearly warn that these actions write files locally and may create persistent application data. In a design-to-code skill, that omission raises the risk of users unintentionally causing filesystem changes or data persistence they did not expect.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill says Figma links should preferentially use a Figma MCP and later supports AI/model integrations, but it does not warn that design assets, screenshots, or potentially sensitive product materials may be transmitted to third-party services. This is especially risky because design artifacts often contain unreleased UI, branding, internal workflows, or user data embedded in mockups.

Credential Access

High

• Category: Privilege Escalation

Content

npm install

# 2. 配置环境变量
cp .env.example .env
# 编辑 .env 填入数据库路径、JWT Secret 等

# 3. 初始化数据库（以 Prisma + SQLite 为例）

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# 2. 配置环境变量
cp .env.example .env
# 编辑 .env 填入数据库路径、JWT Secret 等

# 3. 初始化数据库（以 Prisma + SQLite 为例）
npx prisma migrate dev

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

- `POST /api/resources` — 创建
  - `PUT /api/resources/:id` — 全量更新
  - `PATCH /api/resources/:id` — 部分更新
  - `DELETE /api/resources/:id` — 删除（或软删除）

- **认证与授权**：
  - 用户注册/登录/登出 API

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

根据**完整闭环**中的用户操作路径推导 API：
- 「点击添加 → 新建页 → 保存返回」 → `POST /api/resources`
- 「点击条目 → 详情页 → 编辑/删除」 → `GET /api/resources/:id` + `PATCH /api/resources/:id` + `DELETE /api/resources/:id`
- 「首页浏览 → 下滑查看本周简报」 → `GET /api/resources?range=week&page=1&limit=10`
- 「设置页调整目标与提醒」 → `PATCH /api/users/:id/settings`

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Static analysis

No suspicious patterns detected.