figma-image-downloader
Pass
Audited by Gen Agent Trust Hub on Apr 22, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The bash script uses standard utilities including
curl,jq,sed, andgrepto parse Figma URLs and project metadata. It implements strict sanitization for output filenames usingtr -cs '[:alnum:]' '_', which prevents command injection and path traversal from design data. - [EXTERNAL_DOWNLOADS]: The skill fetches design specifications and image assets from Figma's official API endpoints (
api.figma.com). These downloads are authenticated via a user-provided API key and are limited to the intended functionality of the skill. - [SAFE]: No malicious patterns such as prompt injection, obfuscation, or data exfiltration were detected. The skill manages sensitive credentials via environment variables rather than hardcoding them.
Audit Metadata