figma-make-local-runner
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to clone an external repository from a third-party source not associated with the skill author or a trusted organization.
- Evidence:
git clone https://github.com/likang/figma-make-local-runnerin the Installation section. - [REMOTE_CODE_EXECUTION]: The skill directs the user to install dependencies and run a development server from the cloned repository, which involves executing arbitrary code and scripts defined in that repository.
- Evidence:
npm installandnpm run devcommands which execute code from the untrusted repository. - Evidence: The skill mentions custom Vite plugins (
removeVersionSpecifiersPlugin,figmaAssetPlugin) that are executed during the build and development process.
Audit Metadata