Figma

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:30 AM UTC
• Version: 1.0.2

Overview

This is a Figma guidance skill with disclosed local preference memory and purpose-aligned API/plugin advice, not evidence of hidden or harmful behavior.

Before installing, understand that the skill may use local Figma preference memory under ~/Clawic/data/figma/ and may help draft plugin/API workflows for Figma. Use narrow-scoped Figma tokens, review any generated plugin or REST automation before running it, and avoid using unvetted plugins on confidential files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

| Detaching an instance to get a variant that does not exist | The library link is gone for good; the missing variant never returns to the source | Add the variant or a property; detach only for one-off artwork that will never update |
| `Accept all` on a library update | A restructured main rewires overrides across every consuming file at once, silently | Review per component; open one real consuming screen before accepting a structural change |
| Duplicating frames for dark mode | Two trees drift within a sprint and every fix has to land twice | One tree, a second mode on the color collection |
| Fixed height on a text container | Localization and long strings clip with no warning on the canvas | Auto height on the text node, Hug on the parent, tested against the longest realistic string |
| Tuning constraints inside an auto layout frame | Inert except on absolutely-positioned children — the control does nothing | Fix the sizing modes; use absolute position when out-of-flow is genuinely wanted |
| `Lorem ipsum` in a mock | Hides the real length distribution; the layout breaks the day real copy arrives | Real or realistic copy plus the longest string the field permits |
| Pasting codegen output into production | px values, absolute positioning, and class names with no relationship to the codebase | Read the structure (auto layout maps to flex), rewrite against the codebase's own tokens |

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Hidden Instructions

High

• Category: Prompt Injection

Content

last: YYYY-MM-DD

## Context
<!-- Their file and library structure: how many files, which libraries, who publishes -->
<!-- Design system maturity: styles, variables, or mid-migration -->
<!-- Who consumes the handoff: engineers, agency, an agent pipeline -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Credential Access

High

• Category: Privilege Escalation

Content

## Authentication

- Personal access tokens carry scopes; issue the narrowest scope the job needs and nothing more. A read-only file-content scope cannot be turned into a write by a leaked script.
- OAuth is for anything multi-user: a token belonging to one designer becomes a single point of failure and an offboarding incident the day they leave.
- Never put a token in a plugin bundle (installable and readable), in a client-side app, or in a repo. Repo history retains it after deletion — rotate rather than delete.
- Store tokens in the CI secret store, and prefer a service account over a personal one for pipelines.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Variables endpoint returns forbidden | Tier gate | Export through a plugin instead |
| Pipeline fires constantly | Subscribed to file-update | Subscribe to library-publish |
| Token leaked in a repo | Committed and later deleted | Rotate; history still holds the old value |
| Script works for one person only | Personal access token | Move to OAuth or a service account |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Variables endpoint returns forbidden | Tier gate | Export through a plugin instead |
| Pipeline fires constantly | Subscribed to file-update | Subscribe to library-publish |
| Token leaked in a repo | Committed and later deleted | Rotate; history still holds the old value |
| Script works for one person only | Personal access token | Move to OAuth or a service account |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

# Dev Mode and Handoff

The deliverable is a file an engineer can read without asking questions, not a link and a hope. Dev Mode is the surface; the work is making the tree tell the truth.

## What Dev Mode Gives

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to read from and later write to user-local files containing preferences and prior context, but it provides no user-facing disclosure, consent step, or data-minimization guardrails. This creates a privacy and persistence risk: the agent may silently ingest historical context and store new behavioral/profile data that affects future sessions without the user realizing it.

Natural-Language Policy Violations

Low

• Confidence: 63% confidence
• Finding: The directive 'Do not interview the user' is a natural-language constraint on how the assistant interacts, and later text reinforces 'Never open with questions'. While not explicitly a language setting, it imposes a fixed communication mode without user choice, which may conflict with organizational expectations for user-directed interaction preferences.

Static analysis

No suspicious patterns detected.