figma-bridge
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes
curlcommands to interact with Figma's official REST API (api.figma.com). This is the intended and transparent method for retrieving design file structures, node data, and image assets. - [CREDENTIALS_UNSAFE]: The skill demonstrates secure handling of sensitive credentials. It explicitly instructs the user to provide the Figma Personal Access Token via an environment variable (
FIGMA_TOKEN) rather than hardcoding it or storing it in a persistent file. - [EXTERNAL_DOWNLOADS]: Network operations are restricted to communication with a well-known service (Figma). No downloads or executions from untrusted third-party domains or script repositories were found.
- [SAFE]: The skill operates in a read-only capacity relative to the Figma files, reducing the risk of accidental data modification or destruction.
Audit Metadata