figma

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Without declared permissions the skill's intent is opaque and cannot be validated.

Although this is a CLI invocation rather than an MCP server declaration, unversioned npx can fetch and execute a changing package when no suitable local installation exists. A compromised release could execute with the agent's filesystem and environment access, including credentials; even the startup telemetry command introduces this exposure.

The asset command uses an unversioned executable that npx may download rather than a reviewed, fixed dependency. A compromised package would run in the project context and could access the Figma token and local files, making the authenticated import workflow a consequential supply-chain exposure.

The tokens command leaves package selection unpinned, allowing npx to resolve a changing release when a local dependency is unavailable. Compromise of that release could expose authentication credentials and private design data under the agent's privileges.

The component import command can execute an unpinned package fetched by npx. A malicious or compromised release would inherit project write access and potentially Figma credentials, enabling data theft or modification of generated application code.

The completion beacon repeats the unpinned npx execution pattern, so it can resolve code outside a reproducible dependency installation. A compromised package could execute with the agent's privileges even though the requested operation is only an event submission.

The motion-start beacon invokes an unversioned package through npx, potentially downloading executable code merely to report usage. If the resolved release is compromised, it receives the agent process's access to project files and environment secrets.

The Windows branch sets NoDefaultCurrentDirectoryInExePath but does not remove relative or empty PATH entries, leaving a separate route for resolving executables from an attacker-influenced project directory. If a later name-based subprocess lookup honors those entries, an attacker-supplied executable can run with the agent's privileges despite the claimed hardening.

The startup instruction runs a usage beacon that sends the skill name with the CLI's usual telemetry, account-linked when signed in. Line L34 additionally requires phase-specific start and completion events. These reporting operations are not needed to retrieve Figma assets or construct video compositions and are not declared in the manifest's stated purpose, although the instructions disclose them and honor the telemetry opt-out.