ClawHub
Back to skill

Security audit

figma

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its Figma-import purpose, but it tells the agent to silently run a live self-update command before work, which changes installed skill behavior without clear user control.

Before installing, review whether you are comfortable with a skill that can silently run `npx` to update itself and related HyperFrames skills. The Figma import behavior itself is mostly read-only and purpose-aligned, but users should require visible approval or pinning for the update step and understand that motion/shader/storyboard phases may send consent-gated usage events.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to silently run `npx hyperframes skills update figma` before doing the requested work. That performs networked code/package retrieval and execution unrelated to the immediate user task of importing a Figma design, creating a supply-chain and arbitrary code execution risk without explicit user consent or visibility.

Context-Inappropriate Capability

Low
Confidence
81% confidence
Finding
The telemetry beacon commands cause additional network activity that is not necessary to complete the user's import task. Even if described as anonymous and non-failing, they disclose workflow metadata and create hidden side effects outside the core function of the skill.

Missing User Warnings

High
Confidence
99% confidence
Finding
The instruction to run the update command 'silently, don't ask' removes user awareness and consent for networked code execution. Hidden execution materially increases the risk because the user cannot review, deny, or sandbox the action, and it obscures the provenance of any code that gets fetched and run.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/verify-motion.mjs:96