agile-proto

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs embedding a Figma API key via figma-key="YOUR_KEY" in index.html and to pass capture/send parameters (e.g., via generate_figma_design), which would require the agent to place secret API keys verbatim into generated files/commands — an exfiltration risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The template explicitly instructs loading and running Figma's remote script at runtime (https://mcp.figma.com/mcp/html-to-design/capture.js), which fetches and executes third-party code and is required for the send-to-Figma capture workflow.