type-scale-generator

• Outcome: Pass
• Latest audit: Oct 8, 2026 · 10:13 AM UTC
• Version: 0.1.2

Overview

This typography skill is coherent and user-controlled; its optional Figma writes are disclosed and require explicit user requests.

Install if you want help generating type scales and design tokens. When using it with Figma, review the proposed scale table first and approve only the specific writes you want, since it can create variables, text styles, and a specimen frame in the current file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

When running with Figma access. Each of the three writes below is separate: ask before each one, and do only what was agreed.

- **Check what exists first.** Read the file's text styles (`figma.getLocalTextStylesAsync()`) and variable collections (`figma.variables.getLocalVariableCollectionsAsync()`). If a scale is already in use, show how the new one differs and ask whether to add to it, replace named styles, or stop. Never overwrite a style or variable that has the same name without asking.
- **Variables (on request).** Ask which collection to use or what to name a new one — don't pick a name. Create `FLOAT` variables for each step's font size and line-height in px, with scopes `["FONT_SIZE"]` and `["LINE_HEIGHT"]`, never `ALL_SCOPES`. Use the rounded values from Steps 3–4, never the raw ratio output: Figma renders fractional sizes with the same subpixel risk as CSS.
- **Text styles (on request).** Create one text style per step (`figma.createTextStyle()`), using the family and style read in Step 0 — load the font first. Bind `fontSize` and `lineHeight` to the variables with `textStyle.setBoundVariable("fontSize", variable)` and `("lineHeight", variable)` when variables were created; otherwise set them directly, `lineHeight` as `{ unit: "PIXELS", value }`. Set `letterSpacing` as `{ unit: "PERCENT", value }`. Match the file's existing style naming (`heading/h1`, `Heading/H1`, …); ask if there is none.
- **Specimen (on request).** One Auto Layout frame, one row per step: token name, size / line-height / tracking, and a sample line set in that step's text style. Place it clear of existing content, not at `0, 0`. Sample text uses the styles — no local overrides — so the specimen stays true when a variable changes.