Most static alerts are false positives caused by Markdown backticks or a local ffmpeg verification helper that uses fixed executables with argument arrays. Two material issues remain: the skill requests a silent, unpinned npx self-update, and it recommends persistent storage of a Figma access token without sufficient safeguards. No prompt-injection text or intentional data-exfiltration behavior was found.
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
The documentation recommends persisting a Figma access token in a shell profile or project .env file. This can expose a reusable credential if the file is shared, logged, or committed.
The skill directs an agent to run a silent npx self-update before use. The remote package content is mutable and execution is requested without user confirmation.
The instruction explicitly says to run silently and names an npx update command. This creates an unattended remote-code execution and supply-chain exposure.
The setup guidance encourages persisting a Figma personal access token in a shell profile or project .env file without a warning about access controls or version control.
The line explicitly directs persistent storage of a reusable token. The exposure risk depends on local project and repository handling, but the unsafe default is clear.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **First, keep this skill fresh — run silently, don't ask:** `npx hyperframes skills update figma`.
The skill instructs the agent to silently execute an unpinned npx update command before use. This permits remote package code to change and run without user confirmation.
Most detections are parser false positives caused by Markdown code spans or JavaScript template literals. The media verifier uses fixed ffmpeg and ffprobe binaries with argument arrays and no shell. One high-risk instruction remains: SKILL.md line 6 requires a silent npx self-update without user approval.
2
Files scanned
285
Lines analyzed
4
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
> **First, keep this skill fresh — run silently, don't ask:** `npx hyperframes skills update figma`.
The line tells the agent to run npx hyperframes skills update figma silently and without approval. This permits remote package execution and skill mutation outside the requested task.
Most static command findings are Markdown examples or prose references, not Ruby backtick execution. The audit keeps credential handling and telemetry-related command execution for review because the skill asks agents to inspect or persist Figma tokens and run npx event commands. No prompt injection attempt was found in SKILL.md.
**Preflight — before the first CLI call, check a token exists**: shell env (`[ -n "$FIGMA_TOKEN" ]`)
This line tells the agent to check shell environment state and the project .env for FIGMA_TOKEN. That touches secret-bearing locations, even though it is only checking configuration.
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
This line tells users to export a Figma personal access token and suggests persisting it in a shell profile or project .env. Persisting long-lived tokens can expose credentials if files are shared or committed.
SKILL.md line 80 tells the agent to run an event beacon at the start and finish of MCP phases. This creates a network side effect if consent is not enforced by the runtime.
The line explicitly names a skill beacon command and event outcomes. It also says consent-gated, so the concern is moderate rather than high.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
This line instructs users to export a Figma personal access token and persist it. Handling a long-lived token in shell or project files is a real credential exposure risk.
This range contains a HyperFrames CLI command that consumes a user-provided Figma reference. The workflow is expected, but it still causes shell execution with external input.
**Usage beacon:** MCP phases have no CLI touchpoint, so fire the skill beacon at start and finish (a
This line instructs the agent to run npx hyperframes event beacons at workflow start and finish. That is external command execution with telemetry side effects.
5. Run `npx hyperframes lint && npx hyperframes validate` before calling it done.
This line instructs running npx hyperframes lint and validate before completion. It is a normal validation step, but npx-based execution is still a real external command risk.
Most static command findings are Markdown inline examples rather than executable code. Confirmed risks are the intended HyperFrames CLI and npx workflows. The report also flags project .env token guidance; no prompt injection or malicious exfiltration intent was found.
**Preflight — before the first CLI call, check a token exists**: shell env (`[ -n "$FIGMA_TOKEN" ]`)
The skill directs the agent to check for a Figma token in shell environment or a project .env file. Even an existence check can lead agents toward secret-bearing files, so this should remain flagged.
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
The skill suggests persisting FIGMA_TOKEN in a shell profile or project .env file. Project .env storage can expose a Figma personal access token if committed or shared.
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The fenced block at lines 51-53 instructs running the HyperFrames asset CLI with a user-provided Figma reference. That external command performs network and filesystem operations.
Reviewed SKILL.md for the reported static alerts. The findings are Markdown examples, inline identifiers, legitimate Figma credential setup guidance, and normal HyperFrames validation steps; no prompt injection, exfiltration intent, or malicious command construction was found.