heating the forge...

@forgecat/openai_skills_figma-use — Security Risk Report | ForgeCat

openai_skills_figma-use

Security risk report for @forgecat/openai_skills_figma-use v0.0.10

Low

Profile is sourced from OpenAI's official skills repository (https://github.com/openai/skills) with clear attribution.
Version and commit hash are documented (0.0.10, commit 0e7823cca07bc2cbf34718a383f9ae92525be6a5).
License is Apache-2.0, a well-known open-source license; no supply-chain risk detected.

Low

Content is educational documentation and API reference for the Figma Plugin API; it describes legitimate design automation workflows (creating nodes, components, variables, styles).
No instructions to ignore system prompts, read credentials, exfiltrate data, or execute remote payloads.
Guidance is standard best-practice (load fonts before text operations, use async/await, return node IDs for tracking); no security-weakening or poisoned patterns detected.
Code examples show correct API usage patterns and error handling; no backdoors, typosquatted packages, or malicious templates embedded.

Details

Findings

Invisible characters detected
skills/figma-use/references/api-reference.md · SKILL-011
Invisible characters detected
skills/figma-use/references/gotchas.md · SKILL-011
Invisible characters detected
skills/figma-use/references/validation-and-recovery.md · SKILL-011
Invisible characters detected
skills/figma-use/references/variable-patterns.md · SKILL-011
Invisible characters detected
skills/figma-use/references/plugin-api-standalone.d.ts · SKILL-011

Evidence

README and SKILL.md describe the skill's purpose: 'execute JavaScript in Figma files via the Plugin API' for design tasks.
References like 'gotchas.md' and 'common-patterns.md' document correct vs. incorrect usage; e.g., 'WRONG — modifying in place does nothing' vs. 'CORRECT — clone, modify, reassign'.
No instructions to disable security features, weaken TLS, log credentials, or install attacker-controlled dependencies.

Low

The skill declares no explicit tools or file/shell permissions in the profile itself; authority is delegated to the Figma MCP server.
The MCP server (https://mcp.figma.com/mcp) is a known, legitimate Figma-hosted endpoint for the official Plugin API.
Scope is narrowly focused on Figma file manipulation (design nodes, components, variables, styles) — no filesystem, shell, or arbitrary network access requested.

Details

Evidence

MCP servers section lists only 'figma: https://mcp.figma.com/mcp' with no additional credentials or broad permissions.
Skill description limits use to 'write action or unique read action that requires JavaScript execution in the Figma file context'.

Low

The Figma MCP server is hosted by Figma (mcp.figma.com) — a known, legitimate service provider.
No hidden instructions, arbitrary binary execution, or unrestricted network/filesystem access in the MCP definition.
Server is scoped to Figma Plugin API operations; no environment credentials required beyond standard Figma authentication.

Details

Evidence

MCP definition is minimal: only URL and streamable_http transport type; no suspicious tool descriptions or hidden payloads.
Figma Plugin API is a documented, sandboxed runtime — scripts execute within Figma's plugin sandbox, not on the user's machine.