dev-figma-capture

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill requires generating and then embedding capture IDs (sensitive tokens) verbatim into commands and URLs (e.g., open "<...#figmacapture=<CAPTURE_ID>...>" and --capture-id <CAPTURE_ID>), which forces the LLM to handle and output secret-like values directly, creating an exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The tool intentionally strips CSP, injects a remotely‑fetched script and triggers a capture that submits the full page DOM to an external Figma MCP endpoint — behavior that purposefully bypasses page defenses and can be used to exfiltrate sensitive or internal content (including localhost/admin pages).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The workflow fetches and reads arbitrary outsider-authored web page content at runtime via Playwright (scripts/figma-capture.mjs loads page.goto(opts.url) and then injects/executess scripts and DOM from that page), which can include prompt-injection-like text that becomes part of the LLM-bound flow (e.g., DOM/submitted content) before being sent to Figma/MCP.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The bundled Playwright script performs a runtime fetch of and injects remote executable JavaScript from https://mcp.figma.com/mcp/html-to-design/capture.js into target pages, so external content is fetched at runtime and executed.