figma-core-workflow-b

The code implements a plausible image-export workflow and shows no direct indicators of malware. However, deriving a filesystem path from unsanitized nodeId values creates a potential path traversal and arbitrary file overwrite vulnerability if nodeIds are attacker-controlled. The implementation should validate node IDs, sanitize filename components, resolve and verify that the final path remains under outputDir, and validate fetch responses before writing.