yyl-test-skill

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:46 PM UTC
• Version: 1.0.0

Overview

This Figma skill is purpose-aligned overall, but it needs review because it can write local files using weakly constrained paths and generate unsafe HTML reports from Figma-controlled content.

Review before installing. Use a minimally scoped Figma token, avoid storing it in .env unless the file is gitignored and permission-restricted, run exports into a dedicated directory, and avoid opening generated HTML reports from untrusted Figma files until path containment and HTML escaping are fixed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/accessibility_checker.py:443

Finding

Unescaped Figma Data Allows HTML Injection in Generated Reports

Content

View full analysis

Accessibility Report - {results['file_name']} ``` ```python for issue in results['issues']: severity_class = issue['severity'] html += f"""

{issue['type'].replace('_', ' ').title()}: {issue['message']}

WCAG {issue['wcag_criterion']}

Element: {issue.get('node_name', 'N/A')} (ID: {issue.get('node_id', 'N/A')})

""" if 'details' in issue and issue['details']: html += "

Details:

" for key, value in issue['details'].items(): html += f"
• {key.replace('_', ' ').title()}: {value}
" html += "

" ``` The style-audit report contains the same vulnerability pattern: ```python

File: {audit_results.get('file_name', 'Unknown')}

``` ```python for issue in audit_results['issues']: severity_class = issue['severity'] html += f"""

{issue['category'].title()}: {issue['message']}

Node: {issue.get('node_name', 'N/A')} ({issue.get('node_id', 'N/A')})

Suggestions:

""" for suggestion in issue.get('suggestions', []): html += f"
• {suggestion}
\n" ``` ### Technical Analysis File names, node names, node identifiers, issue messages, detail values, and related report fields are interpolated directly into HTML without contextual output encoding. Several of these values originate in Figma documents and can therefore be controlled by a person who owns or can e ...[truncated 1371 chars]

Remediation

View remediation

`, event-handler attributes, malformed tags, quotes, and ampersands. - Apply the correction consistently to both `accessibility_checker.py` and `style_auditor.py`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/export_manager.py:165

Finding

Unsanitized Client Package Name Permits Output Path Traversal

Content

View full analysis

str: """Create a complete client delivery package with all assets""" if not package_name: file_data = self.client.get_file(file_key) package_name = file_data.get('name', 'figma-package').replace(' ', '-').lower() package_dir = Path(self.config.output_dir) / package_name package_dir.mkdir(parents=True, exist_ok=True) ``` The resulting directory is subsequently used for multiple output operations: ```python self.config.output_dir = str(package_dir / 'frames') Path(self.config.output_dir).mkdir(exist_ok=True) results['frames'] = self.export_frames(file_key) self.config.output_dir = str(package_dir / 'components') Path(self.config.output_dir).mkdir(exist_ok=True) results['components'] = self.export_components(file_key) self.config.output_dir = str(package_dir) results['tokens'] = { 'json': self.export_design_tokens(file_key, 'json'), 'css': self.export_design_tokens(file_key, 'css'), 'scss': self.export_design_tokens(file_key, 'scss') } doc_file = package_dir / 'README.md' self._create_package_documentation(file_key, doc_file, results) ``` ### Technical Analysis `package_name` can come directly from the `--package-name` command-line option. If the option is omitted, it is derived from the remotely retrieved Figma file name. Neither source is restricted to a single safe path component. `Path(output_dir) / package_name` accepts absolute paths and traversal components such as `..`. Replacing spaces and converting text to lowercase does not remove separators or traversal tokens. An absolute package name can discard the configured base directory, while a relative name containing `../` can escape it. The application then creates direc ...[truncated 1163 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Dependency Manifest Introduces Avoidable Supply-Chain Risk

Content

View full analysis

=2.31.0 aiohttp>=3.9.0 pathlib ``` ### Technical Analysis `pathlib` is part of Python's standard library in supported Python versions and does not need to be installed from a package index. Listing it as an external dependency unnecessarily causes package-management tooling to resolve third-party content under a standard-library name, expanding the project's supply-chain attack surface. In addition, `requests` and `aiohttp` use minimum-only version constraints. Installation can therefore select future versions that were not reviewed with this project. The manifest does not provide hashes or a lock file to authenticate exact artifacts. No evidence in the audited code proves that the currently resolved packages are malicious. The finding concerns avoidable and insufficiently reproducible dependency resolution. ### Attack Path 1. A user or deployment process installs the contents of `requirements.txt` from a configured package index. 2. The resolver downloads the unnecessary external `pathlib` distribution and the latest versions satisfying the open-ended constraints. 3. A compromised, malicious, or unexpectedly incompatible future artifact may be selected. 4. Package installation hooks or imported dependency code executes with the privileges of the installing or running account. ### Impact Assessment Potential impact depends on the selected package artifact and the privileges used during installation. A malicious dependency could execute code, access environment variables such as the Figma token, read or modify user-accessible files, and make network requests. The practical risk is reduced because no malicious package was confirmed in the audited repository. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code is consistent with part of the declared description: it performs read-only analysis of Figma files and specifically audits accessibility compliance, including report generation. However, the declared purpose is much broader, emphasizing asset export, design data extraction, design system analysis, and comprehensive design documentation. None of those broader capabilities appear in this code chunk. The actual primary purpose of the supplied code is a specialized WCAG accessibility checker and report generator, not a general-purpose Figma analysis and export tool. Because the declared description materially overstates and broadens the behavior represented by this code chunk, this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The declared description is only partially accurate. The code clearly supports Figma asset export and some reporting/documentation generation, which aligns with part of the description. However, several advertised capabilities are not present: there is no accessibility auditing logic, no meaningful design-system analysis beyond placeholder token extraction, and no comprehensive analysis/reporting engine. Additionally, the description emphasizes 'read-only analysis,' while the code actively writes exported assets and generated files to disk. Although it does not appear to modify Figma content, the local export/write behavior makes the description materially misleading as stated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The code is broadly aligned with a Figma read/export client: it authenticates to Figma, fetches file data, components, styles, versions, and exports images, plus simple analysis helpers for colors and typography. However, the declared description says the skill is for accessibility compliance auditing and generating comprehensive design documentation, neither of which is actually implemented in this chunk. Additionally, the code reaches beyond file-focused design analysis by exposing team/project/component-library endpoints and current user info, which are undeclared capabilities relative to the stated description. There is no evidence here of write/mutation behavior, so the 'read-only' aspect is consistent, but the description is still not an accurate representation of the code's full behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The code is clearly related to the stated domain of Figma analysis and includes accessibility auditing, design system consistency checks, brand compliance checks, multi-file analysis, and report generation, so part of the description is accurate. However, several declared capabilities are not represented in this chunk: there is no asset export functionality, no multi-format export of Figma assets, and no general-purpose extraction of design data beyond reading file structure for audit checks. The 'comprehensive design documentation' claim is also stronger than what the code does, which is limited to audit result reporting in JSON/HTML. Additionally, while the description emphasizes read-only analysis, this script writes output reports to local disk, which is a meaningful undeclared capability/resource access, though not a remote or destructive one. Overall, the description materially overstates and partially mischaracterizes the code's actual behavior.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill explicitly instructs writing a live access token into a .env file using a shell echo command. This is dangerous because .env files are frequently left on disk, accidentally committed, copied into artifacts, or exposed to other local processes, enabling credential theft and unauthorized access to Figma resources.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Set your Figma access token

export FIGMA_ACCESS_TOKEN="your-token-here"

Or store in .env file

echo "FIGMA_ACCESS_TOKEN=your-token" >> .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The .env-based token storage guidance continues the same risky credential-handling pattern by encouraging persistent plaintext secret storage without safeguards. In the context of a network-enabled export/analysis skill, compromise of this token could allow unauthorized access to design files, metadata, and potentially sensitive product assets.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

export FIGMA_ACCESS_TOKEN="your-token-here"

Or store in .env file

echo "FIGMA_ACCESS_TOKEN=your-token" >> .env

text

### Basic Operations

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 7)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 8)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 103)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 112)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 8)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 234)May include surrounding context.

md

5. **User consent**: Request permissions appropriately

### Security
1. **Token protection**: Never expose access tokens in client-side code
2. **Scope principle**: Use minimal required permissions
3. **Input validation**: Validate all user inputs and API responses
4. **Audit logs**: Track API usage for compliance

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

)
        
        if not self.config.access_token:
            raise ValueError("Figma access token required. Set FIGMA_ACCESS_TOKEN env var or pass token.")
            
        self.session = requests.Session()
        self.session.headers.update({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/figma_client.py (reported line 34)May include surrounding context.

python

)
        
        if not self.config.access_token:
            raise ValueError("Figma access token required. Set FIGMA_ACCESS_TOKEN env var or pass token.")
            
        self.session = requests.Session()
        self.session.headers.update({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/figma_client.py (reported line 239)May include surrounding context.

python

)
        
        if not self.config.access_token:
            raise ValueError("Figma access token required. Set FIGMA_ACCESS_TOKEN env var or pass token.")
            
        self.session = requests.Session()
        self.session.headers.update({

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises operational capabilities that inherently require network access, environment variable access, and local file writes, but it does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: users or orchestration layers cannot easily constrain what the skill may access, increasing the risk of unintended credential use, outbound data transfer, or filesystem writes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is described as read-only, but this function writes an HTML report to an arbitrary local path. In an agent environment, disk writes can violate expected capability boundaries, overwrite user files, or leave behind sensitive design data and metadata in persistent storage even if the code is not otherwise malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The CLI JSON output path allows writing analysis results to disk despite the skill being presented as read-only. This creates the same integrity and data handling risk as the HTML path: an agent or user may assume no filesystem side effects while the tool can persist potentially sensitive file analysis results locally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/figma_client.py (reported line 21)May include surrounding context.

python

class FigmaConfig:
    """Configuration for Figma API client"""
    access_token: str
    base_url: str = "https://api.figma.com/v1"
    rate_limit_delay: float = 0.5
    max_retries: int = 3

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest explicitly frames the skill as 'Read-only analysis' with export/reporting capabilities, which justifies reading Figma data and possibly returning export URLs or generated reports. However, this code performs local file writes in download_image and also supports writing arbitrary output to a user-specified path, which goes beyond a purely read-only analysis client and introduces side effects not reflected in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The download_image method writes network-fetched content to an arbitrary caller-supplied path without validation, sandboxing, or user confirmation. In an agent context, this can enable unintended overwrite of local files or placement of attacker-controlled content in sensitive locations if untrusted input reaches output_path.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

When --output is supplied, the script writes the retrieved Figma data to a local file. Although it prints after saving, there is no prior warning in argument help, comments, or docstrings that using this option will create or overwrite a file containing potentially sensitive workspace data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest frames the skill as a read-only Figma analysis/export tool, but this module persists generated HTML reports to the local filesystem. While report/export behavior is partly consistent with the broader description, it is not read-only in an operational sense because it performs local file writes as a side effect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The HTML report embeds unescaped file names, issue messages, node names, and suggestions directly into HTML. If any of those fields originate from untrusted Figma content, opening the generated report in a browser could trigger stored HTML/script injection, exposing local browser context or misleading users reviewing the report.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script serializes audit results and, when --output is provided, writes them to an arbitrary local path. This goes beyond pure read-only analysis of Figma files by modifying the local environment through file creation/overwrite.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.