Figma

This skill includes runnable Python scripts that call the Figma API and write exported assets and reports to disk. Before installing or running it: - Expect to provide a Figma access token (FIGMA_ACCESS_TOKEN). The registry metadata currently does not declare this—verify how the token is read by inspecting scripts/figma_client.py (look for environment variable or file-based token handling). - Review figma_client.py to confirm the only network destination is the official Figma API (api.figma.com) and ensure no unexpected remote endpoints or obfuscated network calls exist. - Run the scripts in an isolated environment (virtualenv, container) and with a scoped or temporary Figma token (principle of least privilege). Revoke the token after use if you are unsure. - Be aware the tool will write exported images, token files, and reports to local directories (configurable output paths). Confirm output paths before running to avoid accidental overwrites. - If you need higher assurance, ask the publisher for corrected registry metadata that explicitly declares the FIGMA_ACCESS_TOKEN requirement and provide a homepage or source repo to review. I rate this suspicious (not clearly malicious) because the functionality is consistent with a Figma export/audit tool but the missing credential declaration and the presence of runnable networked scripts are an incoherence you should resolve before use.