figma-security-basics
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides security-focused instructions for managing Figma API tokens, correctly advising users to store credentials in environment variables and exclude them from version control via .gitignore.
- [SAFE]: Code examples demonstrate secure implementation patterns, such as using crypto.timingSafeEqual for webhook passcode verification to prevent timing attacks.
- [SAFE]: External network references in examples target well-known official domains (api.figma.com) and standard developer tools (gh CLI, jq).
- [SAFE]: The skill includes defensive instructions, such as using git history scanning to identify and remediate previously leaked credentials.
Audit Metadata