figma-ops

The code is a placement-script generator with no evident malicious behavior. However, plan-supplied canvas dimensions and placement coordinates are emitted as raw JavaScript, allowing code injection into the generated script if an untrusted plan is processed and the output is executed. Validate these fields as finite numbers before emission.