figma-export
Pass
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill uses a local script (
figma-export.py) located within the plugin root to interact with the well-known Figma service API. - [SAFE]: Authentication is handled via a standard environment variable (
FIGMA_ACCESS_TOKEN) or a.envfile, which is a recommended practice for secret management. - [SAFE]: The skill documentation explicitly states it uses Python's built-in
urlliblibrary, avoiding external dependencies or untrusted package installations. - [INDIRECT_PROMPT_INJECTION]: The skill accepts a
figma_urlas input and writes to a local file. While this represents an attack surface for processing external data, the functionality is restricted to the specific Figma domain and standard image output, posing minimal risk. Severity is assessed as low risk in accordance with guidelines for this category.
Audit Metadata