Skills figma
๐Ÿ“ฆ

figma

Content revision r2 High Risk โš™๏ธ External commands๐Ÿ“ Filesystem accessโšก Contains scripts

Import Figma designs into HyperFrames

Moving Figma designs into video compositions can require repeated exports and manual reconstruction. This skill imports approved Figma content into local HyperFrames assets, components, tokens, and motion workflows.

Supports: Claude Codex Code(CC)
โš ๏ธ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "figma" from https://skillstore.io/skills/heygen-com-figma.md and its manifest at https://skillstore.io/api/skills/heygen-com-figma/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Test it

Using "figma". Import this Figma logo as an SVG.

Expected outcome:

  • Explains that the selected node will be fetched from Figma.
  • Reports the frozen local asset path and the generated image reference.

Using "figma". Turn this storyboard section into a product demo.

Expected outcome:

  • Lists detected scene order and element chains.
  • Describes proposed transitions, editable components, and any still-image fallbacks.

Security Audit

High Risk
v5 โ€ข 7/19/2026 Open versioned report

Most static alerts are false positives caused by Markdown backticks or a local ffmpeg verification helper that uses fixed executables with argument arrays. Two material issues remain: the skill requests a silent, unpinned npx self-update, and it recommends persistent storage of a Figma access token without sufficient safeguards. No prompt-injection text or intentional data-exfiltration behavior was found.

2
Files scanned
285
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (3)

High
Environment file access
3. `export FIGMA_TOKEN="figd_..."` โ€” and suggest persisting it (shell profile or project `.env`) so
The documentation recommends persisting a Figma access token in a shell profile or project .env file. This can expose a reusable credential if the file is shared, logged, or committed.
High
Silent Unpinned Self-Update
The skill directs an agent to run a silent npx self-update before use. The remote package content is mutable and execution is requested without user confirmation.
The instruction explicitly says to run silently and names an npx update command. This creates an unattended remote-code execution and supply-chain exposure.
High
Credential Persistence Guidance
The setup guidance encourages persisting a Figma personal access token in a shell profile or project .env file without a warning about access controls or version control.
The line explicitly directs persistent storage of a reusable token. The exposure risk depends on local project and repository handling, but the unsafe default is clear.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
Ruby/shell backtick execution
> **First, keep this skill fresh โ€” run silently, don't ask:** `npx hyperframes skills update figma`.
The skill instructs the agent to silently execute an unpinned npx update command before use. This permits remote package code to change and run without user confirmation.
Audited by: claude View Audit History โ†’
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/heygen-com-figma/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/heygen-com-figma/security.svg)](https://skillstore.io/skills/heygen-com-figma?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/heygen-com-figma?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/heygen-com-figma/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/heygen-com-figma.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA ยท BibTeX ยท CFF)

APA citation

heygen-com. (2026). figma security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/heygen-com-figma/audits/5

BibTeX citation

@techreport{heygen-com-heygen-com-figma-2026, author = {heygen-com}, title = {figma security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/heygen-com-figma/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "figma security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "heygen-com" date-released: "2026-07-19" url: "https://skillstore.io/skills/heygen-com-figma/audits/5" identifiers: - type: other value: "skillstore:heygen-com-figma:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
67
Community
83
Spec Compliance

What You Can Build

Create a branded video scene

Import a logo, approved colors, and a Figma frame into a reusable local composition.

Build editable product demos

Convert a Figma UI frame into an editable component and animate the interface states.

Reconstruct a storyboard

Turn a Figma section of related scene frames into an ordered animation plan.

Try These Prompts

Import one asset
Import this Figma logo as an SVG asset. Tell me where the local file is saved.
Import brand tokens
Import tokens from this Figma file and explain which values were imported or unavailable.
Build an editable scene
Convert this Figma frame into an editable HyperFrames component. Use imported tokens when available.
Validate motion translation
Use the Figma motion workflow for this frame. Save the source response, generate the timeline, and validate it against an approved Figma video export.

Best Practices

  • Use a read-only Figma token and limit it to the files required for the import.
  • Import tokens before components when you want reusable brand-variable bindings.
  • Review imported artifacts and validate motion against an approved Figma export before publishing.

Avoid

  • Do not store a Figma token in version-controlled files.
  • Do not treat storyboard frames as a sequence of static slides when they describe element states.
  • Do not use MCP rendering for shader content when Figma documents that shaders are flattened.

Frequently Asked Questions

What Figma access is required?
REST imports require a read-only personal access token. Motion and shader tasks may require the Figma MCP connector.
Does this skill modify my Figma files?
No. The documented integration uses read-only access and creates local HyperFrames artifacts.
Where are imported assets stored?
The workflow stores frozen assets and related metadata in the local project.
Can I import design tokens?
Yes. It imports available variables or published styles, subject to the Figma plan and permissions.
Can it reproduce every animation exactly?
No. Unsupported tracks, complex masks, and shaders can require a native export or baked media.
Why validate imported motion?
Validation compares the produced render with an approved Figma export to identify timing or choreography differences.

Developer Details

Author

heygen-com

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

77d0e66fbadeb1f5d1e6a5aada7861240b8ed2d7

Maintenance freshness

7/19/2026

Usage

2 downloads ยท 0 views

File structure

๐Ÿ“ scripts/

๐Ÿ“„ verify-motion.mjs

๐Ÿ“„ SKILL.md