playwright-figma-scrape
Pass
Audited by Gen Agent Trust Hub on Jul 1, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill documents the use of Figma Personal Access Tokens (PAT) as a fallback mechanism. It correctly advises users to manage these credentials using the macOS Keychain utility (
security add-generic-password), which is a secure and recommended practice for avoiding hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves ingesting data from external Figma documents, including layer names and annotations, using the
browser_evaluateandbrowser_snapshottools. While this data originates from potentially untrusted external sources, the risk is categorized as low as it is inherent to the scraping use case and the skill includes no logic to execute instructions found within the scraped content. - [COMMAND_EXECUTION]: The skill utilizes standard command-line tools such as
curlfor interacting with the official Figma API andsecurityfor credential management. These commands are used appropriately for the skill's stated purpose and do not represent a security risk.
Audit Metadata