Security audit
Security checks across malware telemetry and agentic risk
This Figma skill is not clearly malicious, but it asks for broad command and file access while handling Figma tokens and design data through under-scoped third-party tooling.
Review this skill before installing. Only use it with Figma files you are allowed to process, prefer a least-privilege token supplied through environment variables, avoid pasting real tokens into examples or config files, and confirm where generated code, exported assets, logs, and webhook callbacks will go.
class FigmaDesignEngine:
def __init__(self, access_token: str):
self.access_token = access_token
self.api_base = "https://api.figma.com/v1"
# ...
def get_file_structure(self, file_key: str) -> dict:
"""获取文件完整结构（PRO 专属）"""VirusTotal findings are pending for this skill version.
No suspicious patterns detected.