figma-ci-integration

The workflow is not demonstrably malware, but it has a significant supply-chain and CI security risk: it runs npm installation code from a pull-request checkout and then exposes FIGMA_PAT to repository-controlled code. The export script must be reviewed separately. Use a trusted base-branch workflow or isolated validation job without secrets, pin actions to commit SHAs, restrict permissions, avoid running untrusted lifecycle scripts, and perform the privileged export and push only after trusted review.