Figma设计集成-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:24 AM UTC
• Version: 1.0.2

Overview

The skill appears to be a Figma browsing/export helper, but it asks users to install an unpinned third-party plugin, route Figma data through MorphixAI, and grants broader local capabilities than its free read/export purpose needs.

Review this before installing. Use it only with Figma files you are allowed to share through MorphixAI, verify the plugin source and version yourself, prefer a least-privilege or test Figma account, and revoke or rotate the MorphixAI key when done. Do not let the broad trigger handle unrelated local documents.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:214

Finding

Unpinned Third-Party Plugin Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:214-217
Vulnerability Type: Unpinned executable dependency
Risk Level: Medium

Vulnerable code snippet:

bash

# 1. Install plugin
skill-platform plugins install skill-platform-morphixai

The same unpinned installation command is repeated in the dependency declaration at SKILL.md:332-335.

Technical Analysis

The Skill requires the installation of skill-platform-morphixai by package name but does not specify an immutable version, integrity hash, authoritative registry, verified publisher identity, or reproducible source location.

Consequently, the actual code executed during installation can change after this Skill has been reviewed. The local package contains no plugin implementation that would allow auditors to verify how credentials, Figma data, network requests, or Agent permissions are handled.

This is an insecure dependency configuration rather than proof that the named package is currently malicious. Exploitation requires compromise, substitution, or malicious publication of the external package or its distribution channel.

Attack Path

1. An attacker compromises the package publisher, registry account, package distribution channel, or a mutable future plugin release.
2. The attacker publishes a modified package under the expected package identity.
3. A user follows the Skill instructions and installs the package without a version or integrity constraint.
4. The package executes in the Agent environment with the permissions granted to the plugin or installation process.
5. The compromised plugin reads accessible environment credentials, intercepts Figma operations, modifies returned data, or abuses available local and network capabilities.
6. Sensitive credentials or design information can then be transmitted to an attacker-controlled destination.

Impact Assessment

A compromised dependency could potentially obtain:

...[truncated 615 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a specific, audited version rather than installing the latest mutable release.
2. Require an integrity hash or signed package and verify it before installation.
3. Identify the authoritative registry, package publisher, source repository, and expected signing identity.
4. Publish the plugin source or provide a reproducible-build procedure so its behavior can be independently reviewed.
5. Execute the plugin in a sandbox with restricted filesystem, process, environment-variable, and network access.
6. Prevent the plugin from reading unrelated credentials from the Agent environment.
7. Maintain an approved-version policy and perform a new security review before upgrading the dependency.
8. Prefer manual, administrator-approved installation over allowing the Skill to install executable dependencies during routine use.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:217

Finding

Third-Party Figma Account Delegation Lacks Documented Least-Privilege Controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:217-226
Vulnerability Type: Insufficiently constrained external account delegation
Risk Level: Medium

Relevant configuration flow:

bash

skill-platform plugins install skill-platform-morphixai

export MORPHIXAI_API_KEY="mk_your_key_here"

The surrounding instructions direct the user to create the API key at morphix.app/api-keys and link a Figma account through morphix.app/connections. The dependency section at SKILL.md:335-347 states that the Skill accesses the Figma REST API through a MorphixAI proxy.

Technical Analysis

The workflow delegates access to a user's Figma account and processes Figma resources through a third-party intermediary. The documented capabilities include reading projects, files, nodes, comments, and version history, as well as exporting images.

The Skill does not document:

• The exact OAuth or API authorization scopes requested.
• Whether access can be restricted to selected teams, projects, or files.
• Whether authorization is strictly read-only.
• Which MorphixAI endpoints process the data.
• Data retention, logging, deletion, and onward-sharing policies.
• Token lifetime, rotation, and revocation procedures.
• Tenant isolation or controls preventing cross-account access.

The use of MorphixAI is disclosed, and the audited file contains no evidence that information is covertly exfiltrated. The risk arises because users cannot verify from this project whether authorization and data processing follow least-privilege principles.

Attack Path

1. A user creates a MorphixAI API key and links a Figma account.
2. The user grants the authorization scopes requested by the external service.
3. The Skill invokes mx_figma to request account, project, file, node, comment, version, or export data.
4. MorphixAI processes the request and receives the corresponding Figma data.
5. If the external service, plug ...[truncated 1031 chars]

Remediation

View remediation

Remediation Suggestions

1. Document every Figma OAuth or API scope requested by MorphixAI.
2. Require read-only scopes for the free edition and prohibit comment, file, team, or account modification permissions.
3. Allow users to authorize only selected files, projects, or teams where the Figma authorization model permits it.
4. Document all service endpoints, subprocessors, storage locations, retention periods, and deletion procedures.
5. Provide explicit instructions for revoking the Figma connection and rotating or deleting the MorphixAI API key.
6. Use short-lived, narrowly scoped tokens instead of broad, long-lived credentials.
7. Avoid logging file contents, comments, temporary export URLs, access tokens, or API keys.
8. Display the exact resources and scopes that will be shared before account linking.
9. Consider supporting direct Figma API access so users can avoid unnecessary third-party delegation.
10. Commission an independent review of the plugin and proxy authorization controls before handling confidential designs.

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:40

Finding

Skill Declares Broad Local Tools Beyond the Documented Figma Workflow

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:40-43
Vulnerability Type: Excessive Agent tool permissions
Risk Level: Low

Vulnerable code snippet:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The documented operational workflow primarily uses the remote mx_figma interface to browse and export Figma resources. Nevertheless, the Skill declares general-purpose local read, exec, and write tools.

The installation procedure explains one limited reason for command execution, but the Skill does not establish why arbitrary local file reading and writing are necessary for normal Figma browsing, node inspection, comment viewing, or version-history retrieval. General-purpose execution is also broader than a narrowly restricted plugin installer.

Broad tool declarations increase the consequences of malicious dependency behavior, prompt manipulation, or erroneous Agent decisions. The declaration does not itself prove that local files or commands are abused, but it violates least-privilege design because the documented task can be performed with narrower capabilities.

Attack Path

1. A malicious external dependency, manipulated Figma content, or untrusted instruction influences the Agent's behavior.
2. The influenced workflow invokes one of the broadly declared local tools.
3. The read capability is used to inspect files unrelated to the Figma task, or write is used to alter local content.
4. The exec capability launches commands beyond the intended, verified installation operation.
5. Data accessible to the Agent can be collected, modified, or transmitted through available network functionality.

This path depends on another mechanism gaining control over tool invocation; no such active payload was found in the audited file. The excessive permissions increase blast radius rather than independently proving exploitation.

Impact Assessment

If abused, the dec ...[truncated 545 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove read if local file inspection is not required by a documented workflow.
2. Remove unrestricted write; if export persistence is necessary, expose only a destination-scoped asset-saving operation.
3. Replace general exec with a narrowly scoped, administrator-approved plugin installation action.
4. Require explicit user confirmation before installing dependencies or executing commands.
5. Apply command and argument allowlists rather than permitting arbitrary shell execution.
6. Restrict filesystem access to a dedicated temporary or export directory.
7. Run the Skill and plugin under a low-privilege operating-system identity with no access to unrelated secrets.
8. Deny access to unrelated environment variables and credential stores.
9. Separate one-time installation privileges from normal runtime privileges so routine Figma operations cannot execute local commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger condition says to use the skill whenever file processing, document conversion, format conversion, or content extraction is needed, which is far broader than this skill’s actual Figma-specific purpose. Overbroad routing guidance can cause the agent to send unrelated files or sensitive content into this skill path, potentially exposing local data to external APIs or inappropriate tool use.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill markets itself as a limited, read-oriented free Figma browser, but its manifest grants broad exec and write capabilities and the documentation references create/modify/reset/import actions. This creates a capability mismatch that can mislead agents or users into invoking broader side-effecting behavior than expected, increasing the risk of unauthorized local file changes or arbitrary command execution through the skill wrapper.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes external API-backed access to Figma data and asset export, but it does not clearly warn that workspace metadata, design contents, and exported assets may be transmitted through third-party services and downloaded locally. Without an explicit data-handling warning, users and agents may expose confidential design material without informed consent or proper controls.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation says the free edition cannot post or delete comments, yet later states that the skill supports create/modify/reset/import operations via generic parameters. These contradictory instructions can cause an agent to over-assume permissions and attempt mutating operations against external services or local state, undermining least-privilege expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.