Security audit

figma

Security checks for vulnerabilities and agentic risk

Overview

This Figma skill is a documented Maton API integration with disclosed OAuth use, user-confirmed writes, and no bundled executable payloads.

Install only if you are comfortable connecting a Figma account through Maton. Prefer OAuth, confirm every write or automation setup, avoid raw API keys unless necessary, and review any trigger destination because it can create ongoing data forwarding.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The manifest states that 'variables are not available through this connection,' framing the skill as unable to access that part of Figma. However, the API reference later documents variable write behavior and warns that `POST /v1/files/{file_key}/variables` changes design tokens across the design system, which presents the skill as having that capability.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The caution says variable writes propagate across the design system, implying the operation is relevant and potentially executable. That contradicts earlier statements and the unavailable-endpoints section saying variables are not available through this connection and return 403.

Static analysis

No suspicious patterns detected.