figma
Pass
Audited by Gen Agent Trust Hub on Jun 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes
npxto download and execute the@useclawlink/clipackage from the NPM registry. This package is the official tool provided by the skill author for account management and Figma interaction. - [COMMAND_EXECUTION]: The skill performs its functions by executing shell commands through the ClawLink CLI. This includes authentication (
login), service connection (connect), and design actions (run). - [CREDENTIALS_UNSAFE]: The instructions note that authentication credentials for the ClawLink service are stored locally in the
~/.clawlink/credentials.jsonfile. This is documented for setup transparency and does not include instructions for the agent to access or exfiltrate this sensitive file.
Audit Metadata