Versioned security assessment

Report ID: SA-A10676B9

7/8/2026, 2:19:19 AM

figma security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
figma
Version
v3
Maintainer
heygen-com
Source
github.com/heygen-com/hyperframes/tree/main/skills/figma/
Coverage
1 Files scanned · 123 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

High

3 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

Most static command findings are Markdown examples or prose references, not Ruby backtick execution. The audit keeps credential handling and telemetry-related command execution for review because the skill asks agents to inspect or persist Figma tokens and run npx event commands. No prompt injection attempt was found in SKILL.md.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 123 Lines analyzed

9 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Observed in 1 evidence location

Network access

May connect to external services.

Not recorded by this audit

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 33 evidence locations

Capability review items (6)
Medium
SKILL.md:26
Ruby/shell backtick execution
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
This line instructs users to export a Figma personal access token and persist it. Handling a long-lived token in shell or project files is a real credential exposure risk.
Medium
SKILL.md:51-53
Ruby/shell backtick execution
```bash
This range contains a HyperFrames CLI command that consumes a user-provided Figma reference. The workflow is expected, but it still causes shell execution with external input.
Medium
SKILL.md:59-61
Ruby/shell backtick execution
```bash
This range contains a HyperFrames CLI command that imports tokens from a Figma file. It is legitimate, but it executes local tooling against external project data.
Medium
SKILL.md:69-71
Ruby/shell backtick execution
```bash
This range contains a HyperFrames CLI command that imports a component from a Figma reference. It is expected behavior, but it still invokes local tooling with external input.
Medium
SKILL.md:80
Ruby/shell backtick execution
**Usage beacon:** MCP phases have no CLI touchpoint, so fire the skill beacon at start and finish (a
This line instructs the agent to run npx hyperframes event beacons at workflow start and finish. That is external command execution with telemetry side effects.
Medium
SKILL.md:88-101
Ruby/shell backtick execution
5. Run `npx hyperframes lint && npx hyperframes validate` before calling it done.
This line instructs running npx hyperframes lint and validate before completion. It is a normal validation step, but npx-based execution is still a real external command risk.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (3)

RISK-001 High
SKILL.md:22
Environment file access
**Preflight — before the first CLI call, check a token exists**: shell env (`[ -n "$FIGMA_TOKEN" ]`)
This line tells the agent to check shell environment state and the project .env for FIGMA_TOKEN. That touches secret-bearing locations, even though it is only checking configuration.
RISK-002 High
SKILL.md:26
Environment file access
3. `export FIGMA_TOKEN="figd_..."` — and suggest persisting it (shell profile or project `.env`) so
This line tells users to export a Figma personal access token and suggests persisting it in a shell profile or project .env. Persisting long-lived tokens can expose credentials if files are shared or committed.
RISK-003 Medium
SKILL.md:80
Telemetry Beacon Command
SKILL.md line 80 tells the agent to run an event beacon at the start and finish of MCP phases. This creates a network side effect if consent is not enforced by the runtime.
The line explicitly names a skill beacon command and event outcomes. It also says consent-gated, so the concern is moderate rather than high.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    High
    Figma token handling
    Do not ask agents to inspect project .env files. Direct users to configure read-only tokens outside the repo or in approved secret storage.
  2. FIX-002
    High
    Token persistence guidance
    Remove advice to persist personal access tokens in a project .env unless the file is ignored and the user explicitly approves it.
  3. FIX-003
    Medium
    Telemetry beacon command
    Make event reporting opt-in at runtime, document data sent, and avoid npx execution when a local trusted binary is unavailable.
  4. FIX-004
    Medium
    Shell command examples
    Add explicit escaping guidance for Figma URLs and require confirmation before running CLI commands with user-provided input.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable