Figma Design Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:12 AM UTC
• Version: 1.0.0

Overview

This Figma skill is mostly coherent, but it gives agents broad Figma read/write workflows and token handling guidance without enough scoping or explicit user confirmation for remote changes.

Install only if you want an agent to use Figma credentials and optional Figma MCP access. Keep the Figma token least-privileged, avoid placing it in broadly readable env files, review the hardcoded Omada Figma asset references, and require explicit approval before any write-back or create/modify action in Figma.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (21)

Tainted flow: 'req' from os.environ.get (line 20, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/figma_api.py (reported line 22)May include surrounding context.

python

url = f"{BASE}/{path}"
    req = urllib.request.Request(url, headers={"X-Figma-Token": TOKEN})
    try:
        with urllib.request.urlopen(req, timeout=60) as resp:
            return json.loads(resp.read())
    except urllib.error.HTTPError as e:
        body = e.read().decode() if e.fp else ""

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill claims broad design-to-code, MCP, and write-back functionality that is not actually implemented in the described local code surface. This mismatch is dangerous because operators may trust the skill to perform controlled Figma actions while the real behavior may depend on unspecified external tools or hidden agent capabilities, increasing the chance of unsafe execution paths, over-privileged access, or user deception.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

text

### Environment
Set `FIGMA_TOKEN` (Personal Access Token) in your environment or `.env` file.
Generate at: https://www.figma.com/settings → Account → Personal access tokens

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

### Environment
Set `FIGMA_TOKEN` (Personal Access Token) in your environment or `.env` file.
Generate at: https://www.figma.com/settings → Account → Personal access tokens

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Documenting a specific local secret location and directing the agent to load a token from it meaningfully lowers the barrier to credential access in a shared or automated environment. Combined with shell-based examples, this can encourage token exposure through environment inheritance, process inspection, command history, or accidental logging.

Content

Scanner excerpt · references/guide-for-agents.md (reported line 10)May include surrounding context.

1. 环境与认证

bash

# Token 在 ~/.openclaw/.env 中（自动加载）
export FIGMA_TOKEN="$FIGMA_TOKEN"

# 脚本路径

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/guide-for-humans.md (reported line 31)May include surrounding context.

md

| 条件 | 状态 | 说明 |
|------|------|------|
| Figma Personal Access Token | ✅ 已配置 | 用于 API 读取 |
| 组件库 Published | ✅ 1743+848 组件 | WEB + APP 两套完整组件库 |
| MCP Server | ✅ 免费可用 | Remote MCP，无需桌面端 |
| Code Connect | ❌ 需 Org plan | 组件库到代码仓库的映射（可选，没有也能工作） |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/omada-assets.md (reported line 139)May include surrounding context.

md

| 条件 | 状态 | 说明 |
|------|------|------|
| Figma Personal Access Token | ✅ 已配置 | 用于 API 读取 |
| 组件库 Published | ✅ 1743+848 组件 | WEB + APP 两套完整组件库 |
| MCP Server | ✅ 免费可用 | Remote MCP，无需桌面端 |
| Code Connect | ❌ 需 Org plan | 组件库到代码仓库的映射（可选，没有也能工作） |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/figma_api.py (reported line 165)May include surrounding context.

python

def main():
    if not TOKEN:
        print("Error: FIGMA_TOKEN not set. Export it or add to ~/.openclaw/.env", file=sys.stderr)
        sys.exit(1)

    parser = argparse.ArgumentParser(description="Figma REST API CLI")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that require environment access and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege boundaries and can let the skill run with broader capabilities than users or orchestrators expect, especially since it handles API tokens and remote Figma endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation explicitly describes write operations that can create or modify remote Figma frames, components, pages, and variables, but it does not require an explicit user warning or confirmation before making those changes. In an agent workflow, silent remote modification can damage design assets, create unauthorized changes, or be abused if the skill is activated unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases like design file, component library, design to code, and UI implementation, which can cause the skill to activate in many ordinary development conversations. Over-broad activation increases the chance that the agent unnecessarily accesses Figma-related tools, network resources, or credentials in contexts where the user did not clearly request that behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guide explicitly tells agents where a live Figma token is stored and instructs its use without any guardrails on secret handling, redaction, or least-privilege scope. In an agent-executed environment, this increases the chance of inadvertent credential disclosure, reuse in unintended contexts, or propagation into logs and subprocesses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill includes instructions for creating pages and modifying Figma content but does not warn that these actions can change remote design assets. In an autonomous agent workflow, omission of confirmation/authorization requirements can lead to unintended destructive or unauthorized edits to shared design files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The guide instructs users to provide Figma frame links and project file links to AI tools, but does not warn that those links and the underlying design/code artifacts may contain proprietary or sensitive information. In a design-to-code workflow, this omission can lead to unintentional disclosure of internal product designs, source structure, or customer-related content to external AI services or connected tooling.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/omada-assets.md (reported line 117)May include surrounding context.

md

- **file_key**: `rZaHc0WcrPLWFOlM3OqppI`
- **URL**: https://www.figma.com/design/rZaHc0WcrPLWFOlM3OqppI
- **Pages**: 19
- **核心功能**：DPI 优化、Lightlink VPN (Server/Client)、Content Filtering、QoS、DDNS、Loadbalance、Auto Send Data to Mail

### Design Center-V1.1
- **file_key**: `yjjan3lcHDRsYpdeiDQ6s0`

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/guide-for-agents.md (reported line 64)May include surrounding context.

md

from collections import Counter

TOKEN = os.environ.get("FIGMA_TOKEN", "")
BASE = "https://api.figma.com/v1"


def _get(path: str) -> dict:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/guide-for-agents.md (reported line 68)May include surrounding context.

md

from collections import Counter

TOKEN = os.environ.get("FIGMA_TOKEN", "")
BASE = "https://api.figma.com/v1"


def _get(path: str) -> dict:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/figma_api.py (reported line 14)May include surrounding context.

python

from collections import Counter

TOKEN = os.environ.get("FIGMA_TOKEN", "")
BASE = "https://api.figma.com/v1"


def _get(path: str) -> dict:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

A natural-language policy issue exists when a skill or guide forces a specific language without user opt-in. This file presents all usage instructions only in Chinese and does not state that the guide is intentionally limited to a Chinese-speaking audience or provide an alternative language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file uses Chinese throughout, including the title, headings, and descriptions, with no indication that the skill is intended only for Chinese-speaking users or that a language preference is available. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code file performs a filesystem write by downloading the exported image to a local path via urlretrieve, but the operation has no prior confirmation prompt or explicit warning comment/docstring describing the write behavior. Although writing output is part of an export command's purpose, the code itself does not disclose that it may write to /tmp by default unless the user inspects arguments or output afterward.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.