dev-figma-capture

No explicit malware primitives (e.g., credential theft, filesystem tampering, reverse shells, or direct exfiltration from this snippet) are present. However, the module performs security-relevant and potentially dangerous actions: it globally strips CSP headers for all responses from the visited page and it injects remotely fetched JavaScript into that page context. Combined with user-supplied navigation (--url) and user-controlled path material (--capture-id), this significantly increases the attack surface. The behavior appears purpose-built for a capture workflow, but it should be treated as security-sensitive and reviewed/limited (e.g., restrict allowed URLs, avoid CSP removal, and ensure the fetched script is trusted and integrity-checked).