Security audit

Figma Agent

Security checks for vulnerabilities and agentic risk

Overview

This Figma skill mostly does what it claims, but its setup reads tokens from other local apps and stores a bearer token in OpenClaw config with insufficient scoping and disclosure.

Install only if you are comfortable granting OpenClaw access to the Figma account found in other local MCP clients. Before running bootstrap-token.mjs, use --dry-run, check which credential file it selects, and prefer a duplicate or branch for write workflows. Review ~/.openclaw/openclaw.json permissions and remove or rotate the copied token if you no longer need the integration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/token-scanner.mjs:16
Finding: Cross-Client Credential Discovery and Replication Exceeds Least Privilege
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: README.md:113
Finding: Manual Installation Uses an Unpinned Mutable Repository Source
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
node scripts/figma-mcp-cli.mjs get_screenshot \

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
node scripts/figma-mcp-cli.mjs get_screenshot \

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The skill instructs the agent/operator to read an OAuth token from ~/.claude/.credentials.json and copy it into another config file. This is credential handling and persistence of a sensitive token outside its original store, which increases exposure risk through accidental disclosure, weaker file protections, logging, backup leakage, or reuse by unintended processes.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.
node ~/.openclaw/skills/figma-agent/scripts/auth.mjs

text
Reads CC OAuth token from `~/.claude/.credentials.json`, writes it into `~/.openclaw/openclaw.json`. Then restart the OpenClaw gateway. **Token check:** `node ~/.openclaw/skills/figma-agent/scripts/auth.mjs --check`

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: This code directly targets a credential file path and parses it to recover access tokens, refresh tokens, and client secrets. In the context of a Figma integration skill, intentional credential discovery from another tool's private auth store is especially dangerous because it enables credential access beyond the user’s likely expectations and broadens compromise scope to multiple services or sessions.
Content: Scanner excerpt · scripts/token-scanner.mjs (reported line 16)May include surrounding context.
js
*/ export function scanForFigmaToken() { // 1. Claude Code const claudePath = join(HOME, '.claude', '.credentials.json'); if (existsSync(claudePath)) { try { const creds = JSON.parse(readFileSync(claudePath, 'utf8'));

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 30)May include surrounding context.
md
Figma Agent is not just a raw MCP wrapper. It is a structured OpenClaw skill for working with Figma in two modes: - **Direct read / inspect** for screenshots, metadata, design context, variables, and Code Connect inspection - **Structured write / edit workflows** for building screens, reviewing existing work, applying tokens, and iterating on designs through ACP coding sessions Typical use cases:

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README promotes write/edit workflows that can modify live Figma content but does not clearly instruct users to confirm target files/nodes, verify edit intent, or warn about unintended changes. In an agentic environment, ambiguous edit authority can lead to accidental modification of production design assets or propagation of unwanted changes across shared files.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The bootstrap instructions invoke a script that extracts or refreshes a Figma MCP token and writes server configuration into the user's OpenClaw config, but the README does not present this as a prominent security-sensitive action. Users may run it without understanding that credentials are being harvested from another client context and persisted locally, increasing the risk of secret exposure or unintended account linkage.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill exposes operational behaviors that involve code execution, filesystem access, and likely networked interactions, but it declares no explicit tool scope or allowed-tools boundary. In an agent environment, this increases the chance that the skill can invoke broader capabilities than intended, making misuse or unintended side effects harder to constrain and audit.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example reply text is in German ("Hier ist der aktuelle Stand:") within mandatory delivery instructions, which signals a fixed output language. The file does not offer user opt-in, language selection, or a documented German-only regional justification, so this conflicts with the language/locale policy criteria.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
**Why `--out`?** Without it, the Figma API returns base64-encoded JSON → renders as inline text in Telegram, not a photo. The `--out` flag decodes and writes a real PNG file that `MEDIA:` sends as an attachment. **Screenshot directory:** `~/workspace-dev-botti/screenshots/` (create if missing) **Validation pattern (every write operation):**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The reference documents multiple write-capable tools that can create files, generate designs, add mappings, and execute arbitrary JavaScript in the Figma plugin context, but it does not clearly warn that these operations mutate remote Figma state. In an agent skill, omission of mutation warnings increases the chance an agent or user will invoke destructive or unintended actions under the assumption the tools are informational like the read-only figma__* tools.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/playbooks/stitch-import-cleanup.md (reported line 134)May include surrounding context.
md
| Anti-Pattern | Why It Fails | |-------------|-------------| | Editing colors/layout before fixing text auto-resize | Any write can trigger text reflow in unfixed nodes | | Setting all text to `WIDTH_AND_HEIGHT` without checking context | Column-width text needs `HEIGHT` mode | | Rounding dimensions on auto-layout parents | Can break child sizing — round leaf nodes first | | Skipping font loading before text property changes | Silent failure or error — see [gotchas#promises](../plugin-api-gotchas.md#promises) | | Doing cleanup and tokenization in the same pass | Separate concerns — fix structure first, then bind tokens |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/bootstrap-token.mjs (reported line 32)May include surrounding context.
js
return null; } const metaRes = await fetch('https://api.figma.com/v1/oauth/token'); if (!metaRes.ok) { console.error(`⚠️ Failed to fetch OAuth metadata: ${metaRes.status}`); return null;

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/bootstrap-token.mjs (reported line 38)May include surrounding context.
js
return null; } const metaRes = await fetch('https://api.figma.com/v1/oauth/token'); if (!metaRes.ok) { console.error(`⚠️ Failed to fetch OAuth metadata: ${metaRes.status}`); return null;

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The client accepts an arbitrary URL while always attaching the Figma authorization token, so a caller can direct credentials to a non-Figma endpoint. In an agent/skill context where configuration may be influenced by users or other components, this creates a realistic secret-exfiltration path if the URL is overridden maliciously or mistakenly.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function name, signature, and documentation promise a pre-write safety checkpoint, but the implementation performs a normal write and explicitly skips the checkpoint. In a design-editing skill, this can mislead callers into believing destructive changes are recoverable when they are not, increasing the chance of irreversible modification or loss of design state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code silently falls back to a plain write for a function intended to provide a recovery checkpoint, so safety-sensitive behavior is degraded without notifying the caller. In a write-capable Figma skill, that increases the risk of unrecoverable or hard-to-revert changes because automation may proceed under a false assumption of rollback protection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code enumerates and reads credential stores belonging to other local AI tools (Claude Code, Codex, Windsurf) to extract Figma access tokens, refresh tokens, client IDs, and client secrets. Even though it is limited to local file I/O, this is still credential harvesting behavior outside the immediate scope of a normal Figma integration and creates a high-risk path for unauthorized access to secrets from unrelated applications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The scanner accesses highly sensitive tokens and even client secrets from local credential files without any visible user notice, prompt, or consent in this code path. Secret access without transparency increases the chance of silent credential misuse and makes it difficult for users to understand that installing a Figma skill grants access to authentication material from other tools.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · references/playbooks/design-audit-review.md (reported line 178)May include surrounding context.
md
- Very thin font weights (<300) at small sizes - Text over images without overlay/scrim Report these as "flagged for manual contrast check" — automated WCAG scoring is beyond the scope of a quick audit. ---

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This code conditionally decodes API-returned image data and writes it directly to the path supplied via --out. While the write is part of the documented feature, there is no pre-action user warning or confirmation that an existing file may be overwritten or that binary output will be saved to disk; the only disclosure appears after the write completes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest focuses on interacting with Figma designs, tokens, variables, and Code Connect. Reading OpenClaw configuration from the user's home directory is ancillary local configuration access that is not described in the manifest and is not inherently part of Figma design operations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.