ClawHub
Back to skill

Security audit

Figma设计工具v2

Security checks across malware telemetry and agentic risk

Overview

This appears to be a Figma integration skill, but it asks for broad read/write/command authority and gives overly generic automation instructions that could be used outside its stated Figma purpose.

Review before installing. Use this only for explicit Figma tasks, verify the Figma account and token permissions, and require confirmation before it runs commands, writes files, exports assets, or changes/comments on Figma content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The activation guidance is overly broad and encourages invocation for generic productivity or automation tasks unrelated to the skill's actual Figma scope. In a skill with read/write/exec tools and external data access, broad triggering increases the chance the agent uses it in inappropriate contexts, causing unnecessary command execution, file modification, or transmission of Figma-linked data.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill exposes powerful capabilities including file writes, command execution, and access to external Figma data, but the introductory documentation does not clearly warn users about these side effects. This is dangerous because users may invoke the skill expecting passive design inspection while the agent may execute commands, modify local files, or transmit design data externally without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.