Figma

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:37 AM UTC
• Version: 2.1.0

Overview

The skill is broadly a real Figma analysis/export tool, but its generated HTML reports can include unescaped Figma content that may run active browser content when opened.

Review before installing. Use a least-privileged Figma token from a secret store or environment variable, avoid the --token argument, run exports into a dedicated directory, and treat generated HTML reports as unsafe unless the Figma file and its collaborators are trusted. Prefer pinned dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/accessibility_checker.py:347

Finding

Stored HTML Injection in Accessibility Reports

Content

View full analysis

Accessibility Report - {results['file_name']} ``` ```python for issue in results['issues']: severity_class = issue['severity'] html += f"""

{issue['type'].replace('_', ' ').title()}: {issue['message']}

WCAG {issue['wcag_criterion']}

Element: {issue.get('node_name', 'N/A')} (ID: {issue.get('node_id', 'N/A')})

""" if 'details' in issue and issue['details']: html += "

Details:

" for key, value in issu ...[truncated 2407 chars]

Remediation

View remediation

``` 5. Avoid inline event-capable markup and do not enable scripts in static reports. 6. Add regression tests using malicious file names, node names, IDs, and text values to verify that payloads are rendered as text rather than interpreted as HTML. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/style_auditor.py:655

Finding

Stored HTML Injection in Style Audit Reports

Content

View full analysis

Figma Design Audit Report

File: {audit_results.get('file_name', 'Unknown')}

Audit Date: {time.strftime('%Y-%m-%d %H:%M:%S')}

``` ```python for issue in audit_results['issues']: severity_class = issue['severity'] html += f"""

{issue['category'].title()}: {issue['message']}

Node: {issue.get('node_name', 'N/A')} ({issue.get('node_id', 'N/A')})

Suggestions:

""" for suggestion in issue.get('suggestions', []): html += f"
• {suggestion}
\n" ``` ### Technical Analysis The style auditor treats Figma API metadata as trusted HTML. File names and node names originate in a remotely managed collaborative design and can therefore contain attacker-controlled markup. They are interpolated directly into the report body. The same unsafe construction is used for issue categories, messages, identifiers, suggestions, and recommendations. Although several of these fields are normally produced internally, the absence of contextual escaping means that any field incorporating remote design metadata can become an injection sink. The vulnerability becom ...[truncated 1450 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unnecessary and Non-Reproducible Third-Party Dependencies

Content

View full analysis

=2.31.0 aiohttp>=3.9.0 pathlib ``` ### Technical Analysis The requirements use lower-bound-only version constraints. Consequently, a future installation can resolve to dependency versions that were not reviewed or tested as part of this audit. This weakens reproducibility and expands exposure to future compromised, malicious, or incompatible releases. The project also declares `pathlib`, although `pathlib` is included in the Python standard library for supported modern Python versions. Installing a separately published package with this name is unnecessary and increases the dependency-confusion and supply-chain attack surface. Additionally, `aiohttp` is imported in `scripts/export_manager.py` but is not used by the observed export implementation. The actual download path uses `requests` through `FigmaClient.download_image`. Retaining an unused network dependency creates avoidable installation and maintenance risk. No evidence was found that the currently declared packages are intentionally malicious. The finding concerns avoidable supply-chain exposure and non-reproducible resolution rather than a confirmed compromise of a specific package release. ### Attack Path 1. A user installs the project dependencies: ```bash pip install -r requirements.txt ``` 2. The package resolver selects versions newer than those reviewed because only minimum versions are specified. 3. It also installs unnecessary packages, including the external `pathlib` distribution and unused `aiohttp`. 4. If one of these unnecessary or future-resolved distributions is compromised, malicious installation or runtime code may execute with the privileges of the user performing the installation. ### Impact Assessment Dependency installation code gener ...[truncated 611 chars]

Remediation

View remediation

``` 4. Generate and commit a lock file containing hashes, or use a hash-checked requirements file: ```bash pip install --require-hashes -r requirements.txt ``` 5. Separate direct dependencies from transitive dependencies and document the supported Python version. 6. Use automated dependency scanning and update tooling to review new versions before changing the lock file. 7. Install dependencies in an isolated virtual environment or restricted CI container rather than with administrator privileges. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill overstates major capabilities such as multi-format asset export and comprehensive documentation/reporting when those features are only partial or absent. Overclaiming functionality is dangerous in a security context because it obscures what code actually does, frustrates auditability, and can cause users to trust outputs or workflows that were never implemented or validated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The skill overstates major capabilities such as multi-format asset export and comprehensive documentation/reporting when those features are only partial or absent. Overclaiming functionality is dangerous in a security context because it obscures what code actually does, frustrates auditability, and can cause users to trust outputs or workflows that were never implemented or validated.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill overstates major capabilities such as multi-format asset export and comprehensive documentation/reporting when those features are only partial or absent. Overclaiming functionality is dangerous in a security context because it obscures what code actually does, frustrates auditability, and can cause users to trust outputs or workflows that were never implemented or validated.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Set your Figma access token

export FIGMA_ACCESS_TOKEN="your-token-here"

Or store in .env file

echo "FIGMA_ACCESS_TOKEN=your-token" >> .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

Set your Figma access token

export FIGMA_ACCESS_TOKEN="your-token-here"

Or store in .env file

echo "FIGMA_ACCESS_TOKEN=your-token" >> .env

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 7)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 8)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 103)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 112)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 8)May include surrounding context.

md

## Authentication

### Access Token Setup
1. Generate personal access token: Figma → Settings → Account → Personal Access Tokens
2. For team/organization usage: Create OAuth app for broader access
3. Set environment variable: `FIGMA_ACCESS_TOKEN=your_token_here`

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/figma-api-reference.md (reported line 234)May include surrounding context.

md

5. **User consent**: Request permissions appropriately

### Security
1. **Token protection**: Never expose access tokens in client-side code
2. **Scope principle**: Use minimal required permissions
3. **Input validation**: Validate all user inputs and API responses
4. **Audit logs**: Track API usage for compliance

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

)
        
        if not self.config.access_token:
            raise ValueError("Figma access token required. Set FIGMA_ACCESS_TOKEN env var or pass token.")
            
        self.session = requests.Session()
        self.session.headers.update({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/figma_client.py (reported line 34)May include surrounding context.

python

)
        
        if not self.config.access_token:
            raise ValueError("Figma access token required. Set FIGMA_ACCESS_TOKEN env var or pass token.")
            
        self.session = requests.Session()
        self.session.headers.update({

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Allowing the access token to be passed as a CLI argument exposes it to shell history, process listings, and potentially audit logs on multi-user systems. While convenient, this is a real credential-handling weakness compared with environment variables or secret managers.

Content

Scanner excerpt · scripts/figma_client.py (reported line 239)May include surrounding context.

python

parser.add_argument('--format', default='png', choices=['png', 'svg', 'pdf'])
    parser.add_argument('--scale', type=float, default=1.0)
    parser.add_argument('--output', help='Output file path')
    parser.add_argument('--token', help='Figma access token (overrides env var)')
    
    args = parser.parse_args()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises and demonstrates capabilities that require environment access, network access, and local file writing, but it does not declare any explicit tool scope or permissions boundary. This increases the chance that an agent or reviewer will underestimate what the skill can do, leading to over-broad execution in environments where credential access, downloads, and file creation should be tightly controlled.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest explicitly frames the skill as 'Read-only analysis of Figma files', but this module generates and saves HTML reports to disk. Local file creation is a side effect beyond purely read-only analysis, even though the Figma file itself is not modified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

When --output is provided, the script writes JSON audit results to a file. That behavior conflicts with a manifest claiming read-only analysis if interpreted as no filesystem modification, because the skill performs local writes in addition to analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest explicitly describes the skill as providing read-only analysis, yet this file creates directories and later writes multiple output files as part of export workflows. While exporting is mentioned in the manifest, local filesystem writes are still behaviorally inconsistent with a strict 'read-only' claim.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest advertises extracting design data and analyzing design systems, but the token extraction functions fabricate values such as style-id-derived colors and fixed typography/effect/spacing placeholders instead of reading real token properties from the Figma file. This creates a mismatch between the promised analysis/export fidelity and the actual implementation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function documentation states it extracts color design tokens, which implies returning actual color values from the design. Instead, the code assigns placeholder values based on the first six characters of the style ID, directly contradicting the stated behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation promises extraction of typography tokens from the file, but the function ignores real typography properties and always returns fixed values like 16px, 400, 1.5, and Inter. That is an active contradiction, not merely an omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The function claims to extract effect tokens such as shadows, yet it does not inspect actual effect definitions and instead assigns the same hard-coded shadow value to all effect styles. This contradicts the documented intent of extraction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/figma_client.py (reported line 21)May include surrounding context.

python

class FigmaConfig:
    """Configuration for Figma API client"""
    access_token: str
    base_url: str = "https://api.figma.com/v1"
    rate_limit_delay: float = 0.5
    max_retries: int = 3

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill metadata describes the capability as read-only analysis, but this function writes downloaded content to a caller-supplied local path. That mismatch matters because an agent or user may grant it more trust than warranted, and arbitrary local writes can overwrite files or create unexpected artifacts on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

download_image fetches remote content and writes it directly to a caller-controlled path without path restrictions, overwrite checks, size limits, or content validation. In an agent setting, this can be abused to place arbitrary files in sensitive locations or consume disk space unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.