ux-audit

This CLI utility’s main functionality is safe token parsing/conversion, but it contains a serious security weakness: it uses execSync to run a shell command that embeds a version value originating from an attacker-controlled JSON config (--config). That creates a credible command-injection risk. It also performs runtime download/extraction of an npm tarball without integrity verification, increasing supply-chain attack impact. Treat the tool as unsafe when running with untrusted configs or in sensitive CI environments until execSync usage and download integrity checks are hardened.

No direct evidence of overt malware (e.g., stealer/backdoor/exfiltration) is present in this Bash wrapper alone. However, it contains high-severity security weaknesses: (1) interactive eval on user-controlled input (command injection risk), (2) automatic GitHub cloning of heuristically matched repos that can introduce untrusted code into the audit workspace, and (3) running the external Claude tool with --dangerously-skip-permissions against the resolved workspace. Additionally, it prints the Figma key and the constructed command line, which can leak sensitive data via logs. Treat this as security-sensitive tooling and remediate by removing eval, validating/escaping inputs, tightening clone behavior (allowlists/integrity checks), and avoiding printing secrets.