Baoyu Design

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.1

Overview

The skill is mostly a coherent design/export toolkit, but it needs Review because it can turn third-party design-system prose into agent guidance and has unsafe remote-code and script-execution paths.

Install only if you trust the skill publisher and any design systems you import. Avoid using unknown third-party design-system folders as binding style sources, prefer offline/local vendor dependencies, and review any PPTX export config that includes `showJs` before running exports.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: agents/import-design-system.mjs:187

Finding

Untrusted Design-System Documentation Is Promoted into Binding Agent Instructions

Content

View full analysis

c.name), componentPrompts, componentProps: model.components, readme: readmeContent, tokenNames: model.tokens.map((t) => t.name), sourcePath: entry.sourcePath, hasBundle, }); fs.writeFileSync(path.join(destRoot, '_ds_prompt.md'), promptMd); ``` From `agents/lib/ds-prompt.mjs:219-254`: ```js // source-tree pointer + full guide, inlined (raw — this is a .md file, not embedded HTML) const hasReadme = Boolean(readme && readme.trim()); if (sourcePath) { out.push(''); out.push( 'Everything beyond this runtime copy — mocks to fork, specimens, ui_kits, component ' + `source — lives in the design system's source tree at \`${sourcePath}/\`; read from ` + `there for anything not under \`_ds/${slug}/\`.` + (hasReadme ? " Its guide i ...[truncated 3812 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: agents/build-preview.mjs:104

Finding

Downloaded CDN JavaScript Is Dynamically Executed Without Integrity Verification

Content

View full analysis

ctl.abort(), timeoutMs); try { const res = await fetch(url, { signal: ctl.signal }); if (!res.ok) throw new Error("HTTP " + res.status); return await res.text(); } finally { clearTimeout(t); } } async function vendorFile(name, url, offline) { const p = path.join(VENDOR_DIR, name); const cached = await readMaybe(p); if (cached != null) return cached; if (offline) return null; try { const text = await fetchText(url); await fs.mkdir(VENDOR_DIR, { recursive: true }); await fs.writeFile(p, text); return text; } catch (e) { warn("fetch failed " + url + " (" + e.message + ")"); return null; } } async function loadBuildBabel(offline) { try { const m = await import("@babel/standalone"); return m.default && m.default.transform ? m.default : m; } catch {} // agents/vendor/babel.min.js ships with the skill (the compiler uses it too); // fall back to the versioned cache / unpkg download. const code = (await readMaybe(path.join(VENDOR_DIR, "babel.min.js"))) ?? (await vendorFile( "babel-standalone-" + DEFAULT_BABEL_VERSION + ".min.js", "https://unpkg.com/@babel/standalone@" + DEFAULT_BABEL_VERSION + "/babel.min.js", offline, )); if (!code) return null; try { const sandbox = {}; const mod = { exports: {} }; const fn = new Function( "module", "exports", "window", "self", "globalThis", code + "\n;return module.exports;", ); const res = fn(mod, mod.exports, sandbox, sandbox, sandbox); const B = sandbox.Babel || res || mod.exports; return B && B.transform ? B : null; } catch (e) { w ...[truncated 2877 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (104)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description centers on creating visual design artifacts in self-contained HTML and exporting certain decks to PowerPoint. The supplied code does not implement HTML design authoring, UI mockup generation, deck authoring, design systems management, or PPT export. Instead, it is a command-line video generation tool that loads an HTTP(S) URL in Chromium, appends a capture parameter, runs a rendering/export pipeline, and produces a video file with metadata. This is a materially different primary purpose and introduces undeclared capabilities related to browser-based capture and ffmpeg-backed video rendering.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose focuses on creating and exporting design artifacts such as HTML mockups, prototypes, dashboards, and slide decks. The supplied code does not author, edit, visualize, or export such artifacts directly. Instead, it launches a headless Chromium instance, navigates to a URL, captures screenshots, and drives a timeline bridge to specific times before capture. These behaviors are characteristic of rendering automation or video/frame generation infrastructure, which is materially different from the declared design/mockup/deck-authoring purpose. While browser-based rendering could be a supporting implementation detail in some systems, the specific emphasis on time seeking and raw frame capture indicates a distinct primary purpose not represented by the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is focused on designing and authoring visual/UI artifacts as self-contained HTML and exporting authored slide decks to PowerPoint. The supplied code does not create HTML design artifacts, decks, wireframes, prototypes, or design systems. Instead, it implements a low-level media encoding component that converts PNG frame streams into video formats using ffmpeg. This is a materially different primary purpose and introduces undeclared capabilities related to video generation and external process execution. Therefore, the description does not accurately represent the code chunk's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is centered on creating/designing HTML-based visual artifacts and exporting deck-structured HTML to PowerPoint. The supplied code is unrelated to design artifact creation or PPT export; instead, it supports a video orchestration pipeline by producing timeout-specific troubleshooting messages for bridge/capture/encode phases and ffmpeg. This indicates a materially different primary purpose. No concerning resource access is shown, but the functional domain is clearly mismatched.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about producing visual/design outputs and deck authoring/export workflows. The supplied code does not create, render, export, or manipulate design artifacts, HTML, decks, UI kits, or presentation content. Instead, it implements a low-level filename sanitization helper. While such a helper could be used as a supporting detail inside many systems, this isolated code chunk’s actual purpose is materially different from the declared primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is centered on creating and exporting design artifacts and slide decks in HTML/PPT contexts. The supplied code instead belongs to a video-generation/output pipeline: it determines a media file extension, sanitizes a basename, creates an output directory, and returns a filesystem path for a video/gif file. This is a materially different primary purpose from the declared design/mockup/deck functionality. While directory creation is a supporting detail for its actual task, that actual task itself is unrelated to the declared skill description, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is centered on generating self-contained HTML design artifacts and deck/PowerPoint export. The supplied code does not create design artifacts, HTML mockups, wireframes, prototypes, decks, or design systems. Instead, its primary purpose is media export: rendering an animation or page timeline into an MP4/other video format by controlling playback in a browser, taking screenshots for each frame, and encoding them with ffmpeg. These are materially different capabilities and indicate a different skill domain (video generation/export rather than design artifact authoring). Supporting details like waiting for fonts are not the issue; the core behavior is fundamentally mismatched with the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose focuses on generating self-contained HTML design artifacts and exporting internally-authored slide decks to PowerPoint. The supplied code chunk instead specifies interfaces for exporting rendered content as video or GIF, including codec/container options, timing ranges, capture hooks, and ffmpeg failure reporting. That is a materially different primary capability from design artifact authoring or PPT export, and video export is not disclosed in the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is centered on generating visual design artifacts in self-contained HTML and exporting certain authored decks to PowerPoint. The supplied code does not create, edit, render, or export design artifacts or decks. Instead, it validates facts from a video capture/animation rendering workflow and emits warning flags about rendering conditions. This is a materially different primary purpose, not just an implementation detail of the declared design skill, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description focuses on creating visual design artifacts as self-contained HTML and exporting certain decks to PowerPoint. The supplied code does not implement or support HTML design generation, UI mockups, slide deck authoring, PowerPoint export, or design-system management. Instead, it is clearly related to a video-generation pipeline: building FFmpeg CLI args for multiple media formats, validating capture/render outcomes, and sanitizing basenames/output paths. These are materially different capabilities and indicate a different primary purpose than the declared skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose describes a skill for producing visual/design outputs such as HTML mockups, prototypes, slide decks, and design systems. The actual code shown is clearly a bundled/minified Babel library file (babel.min.js) exposing functions like transform, parse, traverse, resolvePlugin, and loadOptions, which are characteristic of JavaScript transpilation infrastructure. This is not itself implementing design generation, PPT export, or UI artifact authoring behavior. While such a library could be a supporting dependency inside a larger skill, the provided code chunk’s behavior is materially different from the declared end-user purpose and introduces undeclared capabilities related to code transformation. Therefore this chunk does not accurately represent the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code is a standard third-party React production build. Its purpose is to provide UI framework primitives such as createElement, Component/PureComponent, hooks, context, suspense, memo, lazy loading, and scheduling. Those are supporting library capabilities, but on their own they do not implement the declared skill behavior of creating self-contained HTML design artifacts or exporting authored decks to PowerPoint. Because the supplied chunk’s primary purpose is materially different from the declared skill description and lacks the described application-level functionality, this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This code is clearly vendor library code (react-dom.production.min.js), not application or skill logic for generating design artifacts. Its primary behavior is to render React elements into the browser DOM, handle events, manage updates, hydration, suspense, scheduling, and form state. None of that directly implements the declared purpose of creating polished HTML design artifacts, prototypes, or PowerPoint exports. While ReactDOM could be a supporting dependency inside such a skill, the supplied chunk itself does not perform the declared user-facing functionality and instead exposes a materially different primary purpose as generic UI runtime infrastructure. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The code does not implement a design-authoring skill or any logic for creating mockups, HTML artifacts, decks, PPT export, or design systems. Instead, it is a generic third-party frontend runtime library (react-dom) that provides rendering infrastructure for React applications. While such a library could be used in support of a design tool, this chunk itself has a materially different primary purpose and exposes undeclared capabilities unrelated to the stated skill behavior. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

skills/design-components.md) as relevant. Generate the loadable artifacts with `agents/compile-design-system.mjs` and validate with the read-only checker (`agen

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

th `agents/compile-design-system.mjs` and validate with the read-only checker (`agents/check-design-system.mjs`, or the `agents/design-system-checker.md` subage

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

skills/import-from-figma.md`](built-in-skills/import-from-figma.md). It drives `agents/import-figma.mjs`: `outline` first, then `mount`/`materialize`/`render` f

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

rompt.md`). As you build, also record each UI deliverable as an **asset** with `agents/record-asset.mjs` (this even bootstraps `_d_meta.json` for a project that

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · agents/build-preview.mjs (reported line 71)May include surrounding context.

js

return /^(https?:)?\/\//i.test(u);
}
function safeInlineScript(code) {
  return code.replace(/<\/script/gi, "<\\/script").replace(/<!--/g, "<\\!--");
}

const MIME = {

Ae3

High

• Category: analysis-evasion
• Confidence: 90% confidence

Finding

Text artifact contains embedded NUL bytes

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · agents/build-preview.mjs (reported line 637)May include surrounding context.

js

const CSS_IMPORT_RE = /@import\s+(?:url\(\s*(['"]?)([^'")]+)\1\s*\)|(['"])([^'"]+)\3)\s*([^;]*);/g;

async function processCss(cssText, baseDir, ctx, stack = new Set()) {
  let css = cssText.replace(/^/, "");
  const imports = [];
  css.replace(CSS_IMPORT_RE, (m, q1, u1, q2, u2, media) => {
    imports.push({ m, ref: u1 || u2, media: (media || "").trim() });

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code executes spec.showJs with new Function(spec.showJs)() in the browser context, giving attacker-controlled input arbitrary script execution. In this skill, capture specs may be influenced by slide/content generation workflows, so injected code could read DOM content, access same-origin resources, trigger network requests, or tamper with exported artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Arbitrary JavaScript is executed from input without any warning, consent, or visible indication to the user. That lack of disclosure increases the risk of hidden malicious behavior in a design/export skill, where users would reasonably expect rendering and capture, not code execution with browser privileges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The screenshot path repeats the same unsafe pattern by evaluating spec.showJs directly before capture. This enables arbitrary code execution during screenshot generation, which can manipulate the page, exfiltrate accessible data, or perform unwanted actions under the page's origin and privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The screenshot flow also runs input-supplied JavaScript silently, creating a hidden execution path that users are unlikely to anticipate. In the context of a design/deck export skill, this is especially dangerous because capture operations may run automatically and process untrusted generated content.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agents/gen-video/dist/cli.mjs:68

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agents/gen-video/src/orchestrator/encode.ts:64

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: agents/tests/helpers.mjs:35

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/build-preview.mjs:151

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/gen-pptx/dist/capture.iife.js:375

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/gen-pptx/src/browser/capture-editable.ts:32

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/gen-pptx/src/browser/capture-screenshot.ts:11

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/tests/compile-design-system.test.mjs:51

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agents/vendor/fig-materialize.mjs:325