Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a Figma integration skill, but it asks for broad read/write/command authority and gives overly generic automation instructions that could be used outside its stated Figma purpose.
Review before installing. Use this only for explicit Figma tasks, verify the Figma account and token permissions, and require confirmation before it runs commands, writes files, exports assets, or changes/comments on Figma content.
The activation guidance is overly broad and encourages invocation for generic productivity or automation tasks unrelated to the skill's actual Figma scope. In a skill with read/write/exec tools and external data access, broad triggering increases the chance the agent uses it in inappropriate contexts, causing unnecessary command execution, file modification, or transmission of Figma-linked data.
The skill exposes powerful capabilities including file writes, command execution, and access to external Figma data, but the introductory documentation does not clearly warn users about these side effects. This is dangerous because users may invoke the skill expecting passive design inspection while the agent may execute commands, modify local files, or transmit design data externally without informed consent.
No suspicious patterns detected.
