Security audit

Templates

Security checks across malware telemetry and agentic risk

Overview

This skill reads Figma design context and writes local repair artifacts, with sensitive behavior that is mostly disclosed and proportionate to that purpose.

Install this only if you are comfortable letting it read Figma credentials, call Figma APIs, scan the selected repair repository for component-mapping clues, write generated artifacts under .multica/figma-context, and add local Git exclude entries for generated Multica artifacts.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This code does more than 'read' Figma context: it modifies repository Git metadata by appending entries to .git/info/exclude. That is a side effect outside the stated scope of the skill and can surprise users, especially in automation contexts where repository state is expected to remain unchanged unless explicitly authorized.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The module persists multiple artifact files, copies screenshots, writes manifests and summaries, and can delete directories when enforcing size budgets, despite the skill being described as only reading design context. This mismatch increases security risk because operators may grant the skill read-oriented trust while it performs broader filesystem actions that affect confidentiality and integrity of local workspace data.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The script’s behavior materially exceeds its stated purpose of only reading Figma URLs from an issue. It retrieves broader Figma file/node data, exports image artifacts, scans the local repository for Code Connect matches, and writes bundled artifacts to disk, which increases data exposure and operational side effects beyond what a caller would reasonably expect from the skill description.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The repository-wide Code Connect scan traverses local source content even though the skill is described as reading design context from Figma URLs. In an agent environment, this creates an unnecessary cross-boundary data access path from remote issue content to local repository inspection, potentially exposing sensitive code structure or metadata through generated artifacts or downstream outputs.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Appending to .git/info/exclude changes repository metadata without explicit disclosure or consent in the skill behavior. In a skill marketed as reading design context, silently mutating Git configuration is dangerous because it can hide generated content from normal version-control visibility and create trust-boundary violations in developer environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/figma-artifact-writer.test.mjs:351

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/figma-token-store.test.mjs:24

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: tests/redact.test.mjs:12