figma-desktop

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 4:27 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward Figma desktop MCP guide, but users should understand that it gives the agent access to the open Figma file and requires a global npm tool install.

Install only if you trust the mcporter package source and are comfortable letting the agent query the Figma file currently open in the desktop app. Open only the intended design file, avoid sensitive projects unless needed, and prefer a pinned or local mcporter installation where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-29
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

Vulnerable Code

bash

# Install using npm
npm install -g mcporter

# Verify installation
mcporter --version

Technical Analysis

The mandatory setup instructions install mcporter globally without specifying an exact version, package integrity value, or trusted registry. Consequently, the installed code depends on whichever package release the configured npm registry serves when the command is run.

npm packages may execute lifecycle scripts during installation with the privileges of the invoking user. The -g option also installs the executable into a global command location, increasing its reach beyond this project. If the package, its publication account, one of its transitive dependencies, or the configured registry is compromised, following these instructions could install and execute attacker-controlled code.

This finding does not establish that the current mcporter package is malicious. The vulnerability is the absence of dependency pinning, integrity verification, and installation isolation.

Attack Path

1. An attacker compromises the package publisher, npm package, transitive dependency, or registry response.
2. The attacker publishes or serves a malicious release under the expected package name.
3. A user follows the Skill instructions and runs npm install -g mcporter.
4. npm retrieves the current attacker-controlled release because no exact version or integrity constraint is specified.
5. Malicious npm lifecycle code can execute with the installing user's privileges.
6. The malicious package can also place or replace the globally available mcporter executable.
7. Subsequent MCP commands may execute attacker logic while appearing to invoke the legitimate tool.

Impact Assessment

Successful exploitation c ...[truncated 544 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin mcporter to an exact reviewed version rather than installing the latest available release:

   bash

   npm install --save-exact mcporter@<reviewed-version>
   

2. Prefer a project-local dependency governed by a committed lockfile instead of a global installation.
3. Use npm ci with a reviewed package-lock.json in automated or reproducible environments.
4. Document the expected npm registry and prevent fallback to untrusted registries.
5. Verify package provenance and integrity before installation, including publisher identity and the lockfile integrity value.
6. Disable lifecycle scripts with --ignore-scripts when the reviewed package can function without them.
7. Run the tool as an unprivileged user and never recommend sudo npm install -g.
8. Periodically review the pinned version and its transitive dependency tree before controlled upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users to connect to a local Figma MCP endpoint and perform operations like reading selections, file structure, variables, components, and code generation, but it does not clearly warn that these calls may expose sensitive local design context to the agent or downstream tooling. Because the desktop app is implicitly authenticated and no OAuth prompt is involved, users may underestimate the scope of accessible data and unintentionally allow access to proprietary designs or code-related metadata.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and operational instructions are entirely in Chinese, which imposes a locale/language choice on users without any opt-in or explanation that the skill is intended only for a Chinese-speaking audience. Under the language/locale policy, this should either offer language choice or clearly justify the locale constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.