figma-node-fetcher
Pass
Audited by Gen Agent Trust Hub on Mar 8, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The
scripts/figma_fetch.pyscript makes requests toapi.figma.comto retrieve node metadata and images. These requests are authorized using an API token provided by the user. This is a standard integration with a well-known service. - [COMMAND_EXECUTION]: The skill includes Python scripts for initialization and data fetching. These scripts read local configuration files and write design data to the output directory specified by the user.
- [CREDENTIALS_UNSAFE]: The skill manages
FIGMA_ACCESS_TOKENby checking environment variables and local.envfiles. It implements amask_tokenfunction to ensure that only a partial preview of the token is shown in status reports, protecting the secret from exposure in logs. - [PROMPT_INJECTION]: The skill processes data from external Figma files which could theoretically contain malicious instructions. However, the skill acts only as a data fetcher and does not execute the content of the design files. Sanitization is applied to node names used in the filesystem.
Audit Metadata