figma-variables-tokens-generator
Warn
Audited by Gen Agent Trust Hub on Jun 25, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references and provides commands to install a package from a third-party GitHub repository (github.com/Shanmus4/figma-variables-tokens-generator) which is not an established or trusted vendor.
- [REMOTE_CODE_EXECUTION]: The skill uses
npx skills addto fetch and execute remote packages from the specified GitHub repository. This allows the execution of arbitrary code from an external source during the installation process. - [COMMAND_EXECUTION]: The documentation explicitly instructs the agent to use shell-level command execution syntax (prefixing with
!) to perform installations, which can bypass certain agent interface constraints if executed without thorough user review.
Audit Metadata