figma-version-history
Pass
Audited by Gen Agent Trust Hub on Jun 13, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes local bash and Node.js scripts (
scripts/list-versions.shandscripts/diff-versions.mjs) to automate interactions with the Figma REST API and perform data diffing operations. This is standard behavior for the tool's functionality. - [EXTERNAL_DOWNLOADS]: Communication is restricted to Figma's official API domain (
api.figma.com) to retrieve version metadata and document snapshots. These network operations are necessary for the skill's primary purpose. - [SAFE]: No malicious patterns or vulnerabilities were identified. The skill demonstrates good security posture by requiring a Personal Access Token (PAT) to be provided via environment variables, avoiding hardcoded secrets and leveraging well-known service providers.
Audit Metadata