Figma Tw Designer Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:22 AM UTC
• Version: 1.0.0

Overview

This Figma helper has a coherent basic purpose, but it asks for broad command/write authority and a Figma token while the actual executable script is missing and some instructions exceed the stated read/export scope.

Review before installing. Use only with Figma files you are authorized to access, use a narrowly scoped or dedicated Figma token if possible, and avoid running any replacement script from outside the reviewed package. The publisher should bundle the exact implementation, narrow triggers to explicit Figma actions, remove unsupported mutating-operation language, and reduce or constrain write/exec permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:232

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Note

• Location: SKILL.md:22

Finding

Overly Broad and Ambiguous Tool Permissions

Content

View full analysis

Remediation

View remediation

other

Note

• Location: SKILL.md:123

Finding

Missing and Unspecified Executable Implementation

Content

View full analysis

``` ```bash python （请参考skill目录中的脚本文件） export \ --ids , \ --format png \ --scale 2 ``` ```bash python （请参考skill目录中的脚本文件） get-comments ``` ### Technical Analysis The project contains only `SKILL.md`; it does not include the referenced Python implementation. The example commands use a placeholder directing the user to consult a script in the Skill directory, but no exact script filename or verified executable path is supplied. As a result, the advertised Figma API behavior, input validation, endpoint restrictions, output handling, and treatment of `FIGMA_TOKEN` cannot be audited or executed as documented. This is principally a functional-integrity problem, but it also creates a security risk if users attempt to obtain a similarly named implementation from an untrusted external source. ### Attack Path 1. A user configures `FIGMA_TOKEN` as instructed. 2. The user attempts to run one of the documented commands. 3. The command fails because the project contains no referenced script and no executable filename is provided. 4. To make the Skill operational, the user searches for or downloads an unofficial Figma script. 5. The user executes that unreviewed script in an environment containing `FIGMA_TOKEN`. 6. A malicious replacement could read the token, access files available to the process, or transmit sensitive information. The repository itself does not retrieve or execute a remote payload. The risk arises only if a user compensates for the missing implementation by obtaining untrusted code. ### Impact Assessment An untrusted replacement script could obtain the Figma personal access token and perform actions allowed by that token. It could also access local data and network resources available ...[truncated 129 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

本工具属于中等复杂度工具，预计120秒内可完成首次调用。

Step 1：配置访问令牌

在Figma个人设置中生成Personal Access Token(PAT)，并通过环境变量配置：

bash

# macOS / Linux

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

本工具属于中等复杂度工具，预计120秒内可完成首次调用。

Step 1：配置访问令牌

在Figma个人设置中生成Personal Access Token(PAT)，并通过环境变量配置：

bash

# macOS / Linux

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md

### API Key 配置
- **Figma Personal Access Token**：通过环境变量`FIGMA_TOKEN`配置
- **生成路径**：Figma → Settings → Security → Personal access tokens
- **安全要求**：禁止在SKILL.md或脚本中硬编码令牌，禁止提交到版本控制

### 可用性分类

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The visible skill name and the surrounding documentation are presented entirely in Chinese, with no indication that users may interact in other languages or opt into this locale. Under the stated policy, forcing a specific language without user choice is a natural-language policy concern unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill encourages exporting layers and viewing comments from design files but does not prominently warn that these artifacts may contain sensitive product plans, unreleased assets, internal discussions, or customer data. Without a clear warning, users or agents may exfiltrate or persist sensitive content into local storage, logs, or downstream tools unintentionally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is presented as a read/export/comment-view tool, but the documentation also claims support for create/modify/delete-style operations through generic parameters. This mismatch can cause an agent to over-trust the skill and attempt unintended state-changing actions against external systems or local files, expanding capability beyond the declared scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition is overly broad and includes generic design-related tasks such as design creation, poster making, and brand visuals, which exceed the stated Figma file inspection/export scope. In an agent environment, broad triggers can cause inappropriate auto-selection of this skill, leading to unnecessary token use, unintended file access, or execution of commands in contexts where the user did not specifically request Figma operations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The summary describes the skill as a '免费体验版' suitable for personal use, which suggests bounded trial-like behavior, while the body explicitly states '不限制使用次数'. This is a semantic mismatch in how the edition's scope is represented to users, even though both discuss the same product tier.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.