{"data":{"skill":{"slug":"sickn33-figma-automation","name":"figma-automation","icon":"📦","repo":"https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/figma-automation","status":"approved","author":"sickn33","authorVersion":null,"skillstoreRevision":2},"audit":{"id":"4974bd32-d6a7-4d15-a6fe-e2146a887e18","skill_id":"d3550fb5-0811-499d-9eaf-1f3dc5cb1c5f","version":6,"content_hash":"v3:88a8e9a07f4c54ab105c1c41b6267c287146b07b:9a36aa56d68a4ccd7c170ff2720b9c7865bdb74d8820f268946670acd9c3cf59:76d9df4596c33f788eb378f8400b16d97e15ae2c8e32dd3e5ac4d3698e2584aa:736b696c6c732f7369636b6e33332f6669676d612d6175746f6d6174696f6e:8f1c523410f08c3f1dd19c970af92c0b","risk_level":"medium","is_blocked":false,"safe_to_publish":true,"analysis_status":"ok","agent_auto_install_policy":"allowed","manual_install_policy":"allowed","summary":"All 49 shell-execution alerts are false positives caused by Markdown backticks around tool names, parameters, URLs, or workflow examples. The six reconnaissance alerts are also false positives. The external Rube MCP connection and authenticated Figma access create a legitimate third-party data and authorization boundary.","remediation":[{"issue":"Third-party Figma authorization","severity":"medium","suggestion":"Explain that Rube and Composio process Figma data, recommend least-privilege access, and require confirmation before write actions or downloads."},{"issue":"Remote MCP endpoint verification","severity":"low","suggestion":"Link to official setup documentation and tell users to verify the MCP endpoint before entering Figma authorization credentials."}],"risk_factor_evidence":[{"factor":"external_commands","evidence":[{"file":"SKILL.md","line_end":16,"line_start":16},{"file":"SKILL.md","line_end":17,"line_start":17},{"file":"SKILL.md","line_end":21,"line_start":21},{"file":"SKILL.md","line_end":24,"line_start":24},{"file":"SKILL.md","line_end":25,"line_start":25},{"file":"SKILL.md","line_end":36,"line_start":36},{"file":"SKILL.md","line_end":37,"line_start":37},{"file":"SKILL.md","line_end":38,"line_start":38},{"file":"SKILL.md","line_end":39,"line_start":39},{"file":"SKILL.md","line_end":40,"line_start":40},{"file":"SKILL.md","line_end":43,"line_start":43},{"file":"SKILL.md","line_end":44,"line_start":44},{"file":"SKILL.md","line_end":45,"line_start":45},{"file":"SKILL.md","line_end":46,"line_start":46},{"file":"SKILL.md","line_end":50,"line_start":50},{"file":"SKILL.md","line_end":53,"line_start":53},{"file":"SKILL.md","line_end":60,"line_start":60},{"file":"SKILL.md","line_end":61,"line_start":61},{"file":"SKILL.md","line_end":62,"line_start":62},{"file":"SKILL.md","line_end":63,"line_start":63},{"file":"SKILL.md","line_end":66,"line_start":66},{"file":"SKILL.md","line_end":67,"line_start":67},{"file":"SKILL.md","line_end":68,"line_start":68},{"file":"SKILL.md","line_end":69,"line_start":69},{"file":"SKILL.md","line_end":70,"line_start":70},{"file":"SKILL.md","line_end":82,"line_start":82},{"file":"SKILL.md","line_end":83,"line_start":83},{"file":"SKILL.md","line_end":86,"line_start":86},{"file":"SKILL.md","line_end":87,"line_start":87},{"file":"SKILL.md","line_end":88,"line_start":88},{"file":"SKILL.md","line_end":89,"line_start":89},{"file":"SKILL.md","line_end":100,"line_start":100},{"file":"SKILL.md","line_end":101,"line_start":101},{"file":"SKILL.md","line_end":102,"line_start":102},{"file":"SKILL.md","line_end":103,"line_start":103},{"file":"SKILL.md","line_end":106,"line_start":106},{"file":"SKILL.md","line_end":107,"line_start":107},{"file":"SKILL.md","line_end":108,"line_start":108},{"file":"SKILL.md","line_end":109,"line_start":109},{"file":"SKILL.md","line_end":120,"line_start":120},{"file":"SKILL.md","line_end":121,"line_start":121},{"file":"SKILL.md","line_end":122,"line_start":122},{"file":"SKILL.md","line_end":125,"line_start":125},{"file":"SKILL.md","line_end":126,"line_start":126},{"file":"SKILL.md","line_end":141,"line_start":137},{"file":"SKILL.md","line_end":145,"line_start":141},{"file":"SKILL.md","line_end":149,"line_start":145},{"file":"SKILL.md","line_end":158,"line_start":149},{"file":"SKILL.md","line_end":159,"line_start":158}]},{"factor":"network","evidence":[{"file":"SKILL.md","line_end":21,"line_start":21}]}],"critical_findings":[],"high_findings":[],"medium_findings":[{"title":"Third-Party MCP Receives Authenticated Figma Access","locations":[{"file":"SKILL.md","line_end":27,"line_start":21},{"file":"SKILL.md","line_end":109,"line_start":95}],"confidence":0.94,"description":"The workflow authorizes Figma through Rube MCP, then reads files and can add comments. This exposes design data and write actions to a third-party integration.","review_kind":"security","source_category":"semantic","source_severity":"medium","confidence_reasoning":"The setup explicitly requires Rube MCP and Figma authorization. The documented comment workflow includes both read and write operations."}],"low_findings":[{"title":"Hardcoded URL","locations":[{"file":"SKILL.md","line_end":21,"line_start":21}],"confidence":0.98,"description":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","review_kind":"capability","source_category":"network","source_severity":"low","confidence_reasoning":"The setup directs users to configure https://rube.app/mcp and authorize Figma through it. This legitimate dependency creates an external network and third-party trust boundary."}],"dangerous_patterns":[],"files_scanned":1,"total_lines":191,"audit_model":"codex","audited_at":"2026-07-23T22:06:52.494+00:00","created_at":"2026-07-26T12:21:43.513998+00:00","static_findings":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Active Figma connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `figma`","category":"external_commands","line_end":16,"severity":"medium","line_start":16},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas","category":"external_commands","line_end":17,"severity":"medium","line_start":17},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","category":"external_commands","line_end":21,"severity":"medium","line_start":21},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds","category":"external_commands","line_end":24,"severity":"medium","line_start":24},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `figma`","category":"external_commands","line_end":25,"severity":"medium","line_start":25},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `FIGMA_DISCOVER_FIGMA_RESOURCES` - Extract IDs from Figma URLs [Prerequisite]","category":"external_commands","line_end":36,"severity":"medium","line_start":36},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `FIGMA_GET_FILE_JSON` - Get file data (simplified by default) [Required]","category":"external_commands","line_end":37,"severity":"medium","line_start":37},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `FIGMA_GET_FILE_NODES` - Get specific node data [Optional]","category":"external_commands","line_end":38,"severity":"medium","line_start":38},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `FIGMA_GET_FILE_COMPONENTS` - List published components [Optional]","category":"external_commands","line_end":39,"severity":"medium","line_start":39},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"5. `FIGMA_GET_FILE_COMPONENT_SETS` - List component sets [Optional]","category":"external_commands","line_end":40,"severity":"medium","line_start":40},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `file_key`: File key from URL (e.g., 'abc123XYZ' from figma.com/design/abc123XYZ/...)","category":"external_commands","line_end":43,"severity":"medium","line_start":43},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ids`: Comma-separated node IDs (NOT an array)","category":"external_commands","line_end":44,"severity":"medium","line_start":44},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `depth`: Tree traversal depth (2 for pages and top-level children)","category":"external_commands","line_end":45,"severity":"medium","line_start":45},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `simplify`: True for AI-friendly format (70%+ size reduction)","category":"external_commands","line_end":46,"severity":"medium","line_start":46},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ids` must be a comma-separated string, not an array","category":"external_commands","line_end":50,"severity":"medium","line_start":50},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- Response data may be in `data_preview` instead of `data`","category":"external_commands","line_end":53,"severity":"medium","line_start":53},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `FIGMA_GET_FILE_JSON` - Find node IDs to export [Prerequisite]","category":"external_commands","line_end":60,"severity":"medium","line_start":60},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `FIGMA_RENDER_IMAGES_OF_FILE_NODES` - Render nodes as images [Required]","category":"external_commands","line_end":61,"severity":"medium","line_start":61},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `FIGMA_DOWNLOAD_FIGMA_IMAGES` - Download rendered images [Optional]","category":"external_commands","line_end":62,"severity":"medium","line_start":62},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `FIGMA_GET_IMAGE_FILLS` - Get image fill URLs [Optional]","category":"external_commands","line_end":63,"severity":"medium","line_start":63},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `file_key`: File key","category":"external_commands","line_end":66,"severity":"medium","line_start":66},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `ids`: Comma-separated node IDs to render","category":"external_commands","line_end":67,"severity":"medium","line_start":67},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `format`: 'png', 'svg', 'jpg', or 'pdf'","category":"external_commands","line_end":68,"severity":"medium","line_start":68},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `scale`: Scale factor (0.01-4.0) for PNG/JPG","category":"external_commands","line_end":69,"severity":"medium","line_start":69},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `images`: Array of {node_id, file_name, format} for downloads","category":"external_commands","line_end":70,"severity":"medium","line_start":70},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `FIGMA_EXTRACT_DESIGN_TOKENS` - Extract colors, typography, spacing [Required]","category":"external_commands","line_end":82,"severity":"medium","line_start":82},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `FIGMA_DESIGN_TOKENS_TO_TAILWIND` - Convert to Tailwind config [Optional]","category":"external_commands","line_end":83,"severity":"medium","line_start":83},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `file_key`: File key","category":"external_commands","line_end":86,"severity":"medium","line_start":86},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `include_local_styles`: Include local styles (default true)","category":"external_commands","line_end":87,"severity":"medium","line_start":87},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `include_variables`: Include Figma variables","category":"external_commands","line_end":88,"severity":"medium","line_start":88},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `tokens`: Full tokens object from extraction (for Tailwind conversion)","category":"external_commands","line_end":89,"severity":"medium","line_start":89},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `FIGMA_GET_COMMENTS_IN_A_FILE` - List all file comments [Optional]","category":"external_commands","line_end":100,"severity":"medium","line_start":100},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `FIGMA_ADD_A_COMMENT_TO_A_FILE` - Add a comment [Optional]","category":"external_commands","line_end":101,"severity":"medium","line_start":101},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `FIGMA_GET_REACTIONS_FOR_A_COMMENT` - Get comment reactions [Optional]","category":"external_commands","line_end":102,"severity":"medium","line_start":102},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"4. `FIGMA_GET_VERSIONS_OF_A_FILE` - Get version history [Optional]","category":"external_commands","line_end":103,"severity":"medium","line_start":103},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `file_key`: File key","category":"external_commands","line_end":106,"severity":"medium","line_start":106},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `as_md`: Return comments in Markdown format","category":"external_commands","line_end":107,"severity":"medium","line_start":107},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `message`: Comment text","category":"external_commands","line_end":108,"severity":"medium","line_start":108},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `comment_id`: Comment ID for reactions","category":"external_commands","line_end":109,"severity":"medium","line_start":109},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"1. `FIGMA_GET_PROJECTS_IN_A_TEAM` - List team projects [Optional]","category":"external_commands","line_end":120,"severity":"medium","line_start":120},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"2. `FIGMA_GET_FILES_IN_A_PROJECT` - List project files [Optional]","category":"external_commands","line_end":121,"severity":"medium","line_start":121},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"3. `FIGMA_GET_TEAM_STYLES` - List team published styles [Optional]","category":"external_commands","line_end":122,"severity":"medium","line_start":122},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `team_id`: Team ID from URL (figma.com/files/team/TEAM_ID/...)","category":"external_commands","line_end":125,"severity":"medium","line_start":125},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- `project_id`: Project ID","category":"external_commands","line_end":126,"severity":"medium","line_start":126},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":141,"severity":"medium","line_start":137},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":145,"severity":"medium","line_start":141},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":149,"severity":"medium","line_start":145},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"```","category":"external_commands","line_end":158,"severity":"medium","line_start":149},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","file":"SKILL.md","pattern":"Ruby/shell backtick execution","snippet":"- URLs use dash format: `node-id=1-541`","category":"external_commands","line_end":159,"severity":"medium","line_start":158},{"id":"network:SKILL.md:21:hardcoded-url","file":"SKILL.md","pattern":"Hardcoded URL","snippet":"**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API k","category":"network","line_end":21,"severity":"low","line_start":21},{"id":"blocker:SKILL.md:74:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"- URLs are temporary (valid ~30 days)","category":"blocker","line_end":74,"severity":"low","line_start":74},{"id":"blocker:SKILL.md:139:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"2. Extract file_key, node_id, team_id from response","category":"blocker","line_end":139,"severity":"low","line_start":139},{"id":"blocker:SKILL.md:170:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Get component | FIGMA_GET_COMPONENT | file_key, node_id |","category":"blocker","line_end":170,"severity":"low","line_start":170},{"id":"blocker:SKILL.md:178:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Team projects | FIGMA_GET_PROJECTS_IN_A_TEAM | team_id |","category":"blocker","line_end":178,"severity":"low","line_start":178},{"id":"blocker:SKILL.md:179:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Project files | FIGMA_GET_FILES_IN_A_PROJECT | project_id |","category":"blocker","line_end":179,"severity":"low","line_start":179},{"id":"blocker:SKILL.md:180:system-reconnaissance","file":"SKILL.md","pattern":"System reconnaissance","snippet":"| Team styles | FIGMA_GET_TEAM_STYLES | team_id |","category":"blocker","line_end":180,"severity":"low","line_start":180}],"finding_verdicts":[{"id":"external_commands:SKILL.md:16:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:17:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:21:ruby-shell-backtick-execution","reason":"The backticks format an HTTPS MCP endpoint in Markdown. They are not Ruby or shell execution syntax.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:24:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:25:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:36:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:37:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:38:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:39:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:40:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:43:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:44:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:45:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:46:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:50:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:53:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:60:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:61:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:62:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:63:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:66:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:67:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:68:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:69:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:70:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:82:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:83:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:86:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:87:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:88:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:89:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:100:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:101:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:102:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:103:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:106:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:107:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:108:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:109:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:120:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:121:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:122:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:125:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:126:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:137:ruby-shell-backtick-execution","reason":"The backticks delimit a plain-text numbered workflow in Markdown. The enclosed lines describe Figma tool calls and do not execute Ruby or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:141:ruby-shell-backtick-execution","reason":"The backticks delimit a plain-text numbered workflow in Markdown. The enclosed lines describe Figma tool calls and do not execute Ruby or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:145:ruby-shell-backtick-execution","reason":"The backticks delimit a plain-text numbered workflow in Markdown. The enclosed lines describe Figma tool calls and do not execute Ruby or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:149:ruby-shell-backtick-execution","reason":"The backticks delimit a plain-text numbered workflow in Markdown. The enclosed lines describe Figma tool calls and do not execute Ruby or shell commands.","verdict":"false_positive","confidence":0.99},{"id":"external_commands:SKILL.md:158:ruby-shell-backtick-execution","reason":"The line uses Markdown backticks to format a Rube or Figma tool name, parameter, or example. It contains no shell command, Ruby interpolation, or execution instruction.","verdict":"false_positive","confidence":0.99},{"id":"network:SKILL.md:21:hardcoded-url","reason":"The setup directs users to configure https://rube.app/mcp and authorize Figma through it. This legitimate dependency creates an external network and third-party trust boundary.","verdict":"confirmed","severity":"low","confidence":0.98},{"id":"blocker:SKILL.md:74:system-reconnaissance","reason":"The text states how long generated image URLs remain valid. It does not inspect the host system or collect system information.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:139:system-reconnaissance","reason":"The line tells the agent to read Figma resource identifiers from a tool response. It does not inspect the local system or environment.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:170:system-reconnaissance","reason":"The line is a reference-table entry for retrieving a Figma component by known identifiers. It does not perform system reconnaissance.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:178:system-reconnaissance","reason":"The line is a reference-table entry for listing Figma team projects. It does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:179:system-reconnaissance","reason":"The line is a reference-table entry for listing files in a Figma project. It does not inspect the host system.","verdict":"false_positive","confidence":0.99},{"id":"blocker:SKILL.md:180:system-reconnaissance","reason":"The line is a reference-table entry for listing published Figma team styles. It does not inspect the host system.","verdict":"false_positive","confidence":0.99}],"semantic_findings":[{"title":"Third-Party MCP Receives Authenticated Figma Access","severity":"medium","locations":[{"file":"SKILL.md","line_end":27,"line_start":21},{"file":"SKILL.md","line_end":109,"line_start":95}],"confidence":0.94,"description":"The workflow authorizes Figma through Rube MCP, then reads files and can add comments. This exposes design data and write actions to a third-party integration.","confidence_reasoning":"The setup explicitly requires Rube MCP and Figma authorization. The documented comment workflow includes both read and write operations."}],"subject_marketplace_commit_sha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","subject_content_hash":"9a36aa56d68a4ccd7c170ff2720b9c7865bdb74d8820f268946670acd9c3cf59","subject_tree_hash":"76d9df4596c33f788eb378f8400b16d97e15ae2c8e32dd3e5ac4d3698e2584aa","subject_plugin_path":"skills/sickn33/figma-automation","audit_payload_hash":"8f1c523410f08c3f1dd19c970af92c0b","confirmed_risk_level":"medium","scanner_version":"3.0.0","policy_version":"skillstore-security-audit-policy-v1","subject":{"marketplaceCommitSha":"88a8e9a07f4c54ab105c1c41b6267c287146b07b","contentHash":"9a36aa56d68a4ccd7c170ff2720b9c7865bdb74d8820f268946670acd9c3cf59","treeHash":"76d9df4596c33f788eb378f8400b16d97e15ae2c8e32dd3e5ac4d3698e2584aa","pluginPath":"skills/sickn33/figma-automation","auditPayloadHash":"8f1c523410f08c3f1dd19c970af92c0b"},"scannerVersion":"3.0.0","policyVersion":"skillstore-security-audit-policy-v1"},"auditTranslation":null,"localization":{"requestedLocale":"en","contentLocale":"en","availableLocales":["en"],"fallbackToEnglish":false},"attestation":{"availability":"issued","url":"/api/skills/sickn33-figma-automation/audits/6/attestation","status":"active"},"trust":{"publicState":"public","auditState":"complete","auditCurrentness":null,"confirmedRiskLevel":"medium","confirmedFindingCount":1,"capabilityReviewCount":1,"needsReviewCount":0,"falsePositiveCount":0,"agentAutoInstallPolicy":"allowed","manualInstallPolicy":"allowed","artifactSignatureState":"available","attestationState":"active","verificationState":"not_verified"},"isLatest":true}}