figma-content-operator

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). The links point to a third‑party GitHub repository (awdr74100) and its release artifacts — an unvetted user/release-based distribution channel for plugin bundles which is a higher-risk source for executable or plugin malware.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). 在“网页复制到 Figma”路径中，工作流会根据用户提供的 --source 打开并在页面上下文执行 assets/webpage-to-figma-runtime.js（从 scripts/webpage-to-figma.mjs 的 page.goto(sourceUrl)/page.addScriptTag({ path: RUNTIME_PATH }) 开始），并通过 page.evaluate(...) 读取网页 DOM 文本/样式用于生成并写入系统剪贴板，因此存在外部作者网页内容进入 LLM 上下文的间接提示注入风险。

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill contains runtime code that fetches and executes remote packages/scripts — e.g., it will download and run an "official" capture.js (via resolveOfficialScript/fetch and page.addScriptTag) and invokes npx to run @modelcontextprotocol/inspector and @figwright/mcp; the skill also explicitly tells the agent to read/download content from these GitHub URLs (https://github.com/awdr74100/figwright/releases/latest and https://github.com/awdr74100/figwright/blob/v0.3.0/skills/figma-build/SKILL.md), so remote content can be fetched and executed at runtime.