T09 · Insecure Skill Coding Practices
Error
- Location
scheme_generation_design_writing技能安装使用手册.md:107- Finding
Figma API Client Configured to Disable TLS Certificate Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Scheme Generation Design Writing
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent document-generation purpose, but its setup guide tells users to permanently weaken Figma HTTPS protections while handling Figma tokens and design data.
Review carefully before installing. Use only approved historical-project folders, avoid secrets or regulated data, and do not follow the manual's instruction to set verify=False or suppress HTTPS warnings for Figma. If using Figma, keep the token read-only, store it securely, and use proper trusted CA/proxy configuration instead of disabling certificate checks.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scheme_generation_design_writing技能安装使用手册.md:208- Finding
Unpinned Third-Party Python Dependencies Installed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (48)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding indicates the package may also perform validation, traversal, file statistics, and upload-precheck style actions that are outside the stated document-authoring purpose. Even if individually low risk, undisclosed auxiliary operations widen the operational surface and make it harder for users and reviewers to understand what data is being inspected or transformed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding indicates the package may also perform validation, traversal, file statistics, and upload-precheck style actions that are outside the stated document-authoring purpose. Even if individually low risk, undisclosed auxiliary operations widen the operational surface and make it harder for users and reviewers to understand what data is being inspected or transformed.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding indicates the package may also perform validation, traversal, file statistics, and upload-precheck style actions that are outside the stated document-authoring purpose. Even if individually low risk, undisclosed auxiliary operations widen the operational surface and make it harder for users and reviewers to understand what data is being inspected or transformed.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
text # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md # 快速开始指南 本指南将帮助你快速上手使用"概念方案生成与设计说明撰写"技能。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
md 如果需要重新建立索引，删除索引文件即可： `ash rm data/project_index.json python scripts/index_projects.py `
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### 4.2 获取Figma个人访问令牌 1. 登录Figma官网：https://www.figma.com 2. 点击右上角头像 → 进入「Settings」设置页面 3. 下拉到「Personal access tokens」区域 4. 输入令牌名称（例如`OpenClaw-Design`）→ 点击「Create token」 5. **立即复制生成的令牌**（只会显示一次，关闭页面无法再次查看） 6. 权限建议：仅勾选`Files:Read`只读权限即可
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide explicitly instructs users to modify the Figma client to disable TLS certificate verification and suppress SSL warnings. This enables man-in-the-middle interception of Figma API traffic, exposing access tokens and design data while removing the user's ability to notice certificate problems.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Disabling SSL certificate verification for outbound Figma requests without warning or compensating controls is an unsafe practice. In this skill's context, the feature handles remote design files and bearer tokens, so insecure transport directly increases the risk of credential theft and tampering.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all user-facing documentation in Chinese, including headings, instructions, and descriptions, but does not indicate that the user can choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README encourages analysis of historical project materials and Figma designs, which commonly contain proprietary product plans, customer data, internal UX research, or unreleased designs, but it provides no warning about data sensitivity, access control, or safe handling. In a skill whose core purpose is ingesting and transforming internal design artifacts, omission of privacy and confidentiality guidance increases the risk of unintentional disclosure or inappropriate processing.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill describes behavior that reads historical project files and writes output/index files, but it declares no explicit tool scope or permissions boundary. In a skill ecosystem, missing scope declarations can cause the agent to request or exercise broader filesystem access than users expect, increasing the chance of unintended access to sensitive project data or unauthorized file creation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The workflow explicitly scans historical project directories and reads related project documents, which may contain confidential client data, internal design artifacts, or regulated information. Without a clear privacy warning and consent model, users may expose sensitive repositories to the agent unintentionally.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill supports Figma link analysis and design information extraction, but it does not clearly warn that potentially sensitive design data may be fetched, processed, or transmitted through another skill/integration. Design files often contain unreleased product details, customer branding, and internal annotations, so silent processing creates material confidentiality risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file states that the skill automatically generates documents from historical project materials and Figma designs, which may contain proprietary or sensitive content. Under the markdown-file criteria for missing user warnings, the description should disclose privacy or data-handling implications when user data could be affected.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This manifest-like JSON example and all accompanying explanatory text are entirely in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Line L066 explicitly instructs that the content must be written in Chinese. This is a natural-language locale constraint, and the file does not offer a user language choice or explain a region-specific justification for requiring Chinese.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L058 states '使用中文撰写' as a blanket requirement. This is a natural-language locale policy constraint that forces a specific language without any opt-in, alternative, or documented region-specific justification.
- Content
Static analysis
No suspicious patterns detected.