bulk-import

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill requires calling generate_auth_token and then inserting the returned auth token directly into the CLI invocation (--auth-token {TOKEN}), which forces the LLM to handle and emit the secret verbatim.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow reads outsider-authored design-system files from the user’s disk (via “Read tools”/file discovery) and then uploads them for processing, which implies their free-text contents (e.g., .md, .tsx, .css) can be ingested into the agent/LLM context during import.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs runtime execution of remotely fetched code via the npm runner command "npx @subframe/cli@latest import -p {PROJECT_ID} --manifest .subframe/import-design-system.json --auth-token {TOKEN}", which will download and execute a package at runtime.