Security audit

Figma Plugin Writer

Security checks for vulnerabilities and agentic risk

Overview

This skill is for generating Figma designs, but its default templates can delete all content on a Figma page without confirmation.

Review before installing or using. Only run generated plugins on a disposable or duplicated Figma page/file, and prefer changing the skill to create or replace a named plugin-owned frame instead of clearing an entire page. Do not run the examples as-is in a document page that contains valuable work.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:102
Finding: Unconditional deletion of all content on the target Figma page
Content: View full analysis
c.remove())` 2. Recreate design with changes 3. Notify user to re-run the plugin ``` All three executable examples implement the same operation. For example: ```js // Get the last page var pages = figma.root.children; var target = pages[pages.length - 1]; await figma.setCurrentPageAsync(target); // Clear old content var old = target.children.slice(); for (var i = 0; i < old.length; i++) old[i].remove(); ``` The design-system example contains: ```js var pages = figma.root.children; var target = pages[pages.length - 1]; await figma.setCurrentPageAsync(target); var old = target.children.slice(); for (var i = 0; i < old.length; i++) old[i].remove(); ``` The multi-screen example contains: ```js var pages = figma.root.children; var target = pages[pages.length - 1]; await figma.setCurrentPageAsync(target); var old = target.children.slice(); for (var i = 0; i < old.length; i++) old[i].remove(); ``` ### Technical Analysis The Skill directs generated plugins to select the last page in the current Figma d ...[truncated 2434 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs code to clear all children from a target page before rebuilding the design, but it does not require a clear user confirmation or warning that existing work will be deleted. In the context of a Figma plugin writer, this is plausibly intended as a convenience reset pattern, but it can still cause accidental destructive modification and data loss if the plugin is run on a page containing valuable designs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code copies the target page's children and removes every node without prompting the user or limiting deletion to plugin-created content. This can cause irreversible loss of design work on the last page in the document if the user runs the example as-is, making it a genuine destructive behavior issue even though it appears unintentional in an example script.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file is presented as an example that 'creates a basic Design System component library', but it selects the last page and removes all existing children before creating new content. This mismatch between described behavior and actual destructive behavior can cause unintended loss of user work, especially in a design-tool plugin context where users may run sample code with trust.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code copies the target page's children and unconditionally removes them all with no prompt, preview, backup, or scope limitation. In the Figma plugin context, this is dangerous because running the example can immediately destroy legitimate page contents and there is no in-code safeguard to ensure only plugin-owned nodes are deleted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script unconditionally removes all existing children from the target page after switching to the last page, which can destroy prior user work without warning or consent. In a design-tool plugin context, this is dangerous because data loss is immediate and irreversible from the script's perspective, even if the author likely intended to reset the canvas for a demo.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.