figma-to-elementor

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly asks the user to paste a Figma personal access token (and references calling the Figma REST API), which requires the agent/LLM to receive and use a secret and could lead to the token being included in requests, code snippets, or logs—an exfiltration risk.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (low risk: 0.10). The skill reads outsider-authored free text only from the Figma node tree (TEXT characters) obtained via connected Figma MCP or Figma REST API for a selected frame; the workflow doesn’t ingest arbitrary user/post content streams without selecting a specific Figma frame.