Security audit

Figma

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Figma connector behavior is mostly clear, but its setup instructions include unverified remote installer commands that could run arbitrary local code.

Review the setup steps before installing. Prefer a verified or package-manager installation of the oo CLI, avoid piping remote scripts directly into a shell, and confirm exact payloads before allowing write or destructive Figma actions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:78
Finding: Unverified Remote Shell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 78–81 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```bash - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ``` ### Technical Analysis The installation instruction pipes a mutable network response directly into Bash. The downloaded script is not pinned to a specific release and is not checked against a cryptographic digest or trusted signature before execution. Although installing the `oo` CLI supports the Skill's declared Figma functionality, executing unverified remote code is broader than the minimum capability required. The actual code executed can change after the Skill has been reviewed. Compromise of `cli.oomol.com`, its deployment pipeline, or the TLS/DNS trust path could therefore turn this instruction into arbitrary local code execution. The `-f`, `-s`, and `-S` options affect error handling and output but do not establish the integrity or authenticity of the script beyond ordinary HTTPS transport. ### Attack Path 1. The `oo` command is unavailable on the Agent's host. 2. The Agent follows the first-time setup instructions in `SKILL.md`. 3. `curl` retrieves the current content of `https://cli.oomol.com/install.sh`. 4. The response is passed directly to Bash without being saved, reviewed, pinned, or cryptographically verified. 5. If the remote host or delivery chain has been compromised, attacker-controlled shell commands execute with the privileges of the Agent process. 6. Those commands can access or modify any files, processes, credentials, and network resources available to that local account. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the Agent. Depending on that account's permissions ...[truncated 658 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe a network response directly into a shell. 2. Reference a version-pinned CLI release from an authenticated official release channel. 3. Download the installer or package without executing it: ```bash curl --fail --location --output oo-install.sh \ https://example.invalid/releases/vX.Y.Z/oo-install.sh ``` 4. Publish and verify a cryptographic checksum or trusted digital signature before execution. 5. Allow the user to inspect the downloaded file before running it. 6. Require explicit user approval before installing software or invoking any privilege-elevation mechanism. 7. Prefer a signed native package or package-manager installation with version pinning. 8. Document the expected files, permissions, and network endpoints used by the installer. ]]>

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:83
Finding: Unverified Remote PowerShell Script Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 83–85 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High ### Vulnerable Code ```powershell ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The Windows setup instruction retrieves a mutable PowerShell script with `Invoke-RestMethod` (`irm`) and immediately evaluates it with `Invoke-Expression` (`iex`). There is no version pinning, signature validation, checksum verification, or opportunity to inspect the response. `Invoke-Expression` interprets the entire remote response as PowerShell code in the current process context. As a result, the security boundary is effectively delegated to the current content served by the remote endpoint. A compromise of the distribution service or delivery chain can produce arbitrary PowerShell execution after the Skill package has already passed review. Installing a CLI may be relevant to the declared functionality, but immediate execution of mutable remote content exceeds the minimum privileges needed to provide installation guidance. ### Attack Path 1. A Windows host does not have the `oo` CLI installed. 2. The Agent or user follows the documented first-time setup command. 3. `Invoke-RestMethod` downloads the current response from `https://cli.oomol.com/install.ps1`. 4. The pipeline sends the unverified response to `Invoke-Expression`. 5. Attacker-controlled PowerShell executes with the privileges and environment of the Agent or user. 6. The payload can invoke native executables, alter files or PowerShell profiles, access credentials available to the process, and download further payloads. ### Impact Assessment Successful exploitation grants arbitrary code execution within the Windows account running the command. Potential consequences include: - Access to files and secrets available to the current user. - Modification or replace ...[truncated 501 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `irm ... | iex` installation pattern. 2. Distribute a versioned, Authenticode-signed PowerShell script or signed installer. 3. Download the artifact to disk without executing it: ```powershell Invoke-WebRequest ` -Uri "https://example.invalid/releases/vX.Y.Z/install.ps1" ` -OutFile ".\install.ps1" ``` 4. Validate the Authenticode signature and a separately published cryptographic checksum. 5. Present the pinned version and expected publisher to the user. 6. Require explicit user authorization before running the verified installer. 7. Avoid requesting administrator privileges unless a documented installation step strictly requires them. 8. Prefer a trusted package manager that supports signed metadata and fixed versions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:28
Finding: Unsafe Shell Construction for Connector JSON Payloads<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28–34 **Vulnerability Type**: Potential shell command injection through unsafe quoting **Risk Level**: Medium ### Vulnerable Code ```bash **2. Run the action** with a JSON payload that matches the input schema: ```bash oo connector run "figma" --action "<action_name>" --data '<json>' --json ``` - `--data` takes a JSON object string or `@path/to/file.json`; omit it to send `{}`. ``` ### Technical Analysis The instructions demonstrate placing generated JSON directly inside a single-quoted shell argument. JSON strings may legitimately contain apostrophes. If an Agent performs literal substitution into this template, an attacker-controlled apostrophe can terminate the shell quote. Subsequent characters may then be interpreted as shell syntax rather than as JSON data. JSON serialization alone does not provide shell escaping. JSON's escaping rules apply to double-quoted JSON strings, while the surrounding command uses shell single quotes. Consequently, content that is valid JSON can still alter shell parsing when interpolated into this command template. The same documentation already supports `--data @path/to/file.json`, which avoids embedding payload contents in shell command text and is the safer minimum-privilege mechanism. ### Attack Path 1. An attacker controls or influences a value that the Agent is asked to send to Figma, such as a comment or dev-resource field. 2. The supplied value includes an apostrophe followed by shell metacharacters and attacker-selected command text. 3. The Agent serializes the value as JSON and substitutes it literally for `<json>` in the documented command. 4. The apostrophe terminates the shell's single-quoted argument. 5. The shell interprets the remaining metacharacters as command syntax. 6. The injected command executes with the local privileges of the Agent process. Exploitation depends on the Agent constructing the command through a shell using l ...[truncated 898 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make file-based payload submission the required method for nontrivial or externally influenced data: ```bash oo connector run "figma" \ --action "<action_name>" \ --data @/path/to/payload.json \ --json ``` 2. Generate the JSON file with a proper serializer rather than shell string concatenation. 3. Create temporary payload files with permissions restricted to the current user. 4. Delete temporary files after the command completes, unless retention is explicitly required. 5. Where supported, execute `oo` directly with a structured argument array instead of invoking it through a shell. 6. Validate `<action_name>` against the enumerated connector actions rather than accepting arbitrary text. 7. Add an explicit warning that user-controlled values must never be interpolated into shell command strings. 8. Do not attempt ad hoc escaping; use process APIs or the documented `@file` mechanism to keep data separate from command syntax. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

External Script Fetching

High

Category: Supply Chain
Content: - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell
Confidence: 95% confidence
Finding: The skill instructs the agent to install software via `curl ... | bash`, which executes remote script content directly without verification. In a skill file treated as untrusted input, this is dangerous because a compromised upstream host, tampered network path, or malicious script update could lead to arbitrary code execution on the user's system. The skill context makes this more dangerous because the installation command is presented as an automatic recovery path when `oo` is missing.

Intent-Code Divergence

Low

Confidence: 95% confidence
Finding: Line L045 labels `get_component_set` with `[write]` while the action description says 'Get metadata for a published Figma component set by key,' which is a read operation. This is an active contradiction in the skill documentation and could cause unnecessary user confirmation or confusion about the action's effect.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: Line L054 marks `list_comment_reactions` as `[write]`, but the text says 'List emoji reactions on a Figma file comment,' which describes a read-only operation. This directly contradicts the documented safety model in later lines that equate `[write]` with state changes.

Static analysis

No suspicious patterns detected.