figma

ISSUES FOUND max severity CRITICALSkillSpector Caution 29 registry heygen-com last scanned 1 scan

3 findings (2 critical, 1 info), mainly command injection, policy violation. Most recent scan 2026-10-22.

Findings3
Critical2
High0
Medium0
Low0
Analyzersstatic bytecode pipeline correlation behavioral trigger
Scanner version2.3.1

Second scanner: NVIDIA SkillSpector

VerdictCaution 29
Score29 / 100
Issues5
CategoriesMCP Rug Pull Privilege Escalation
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

Bring Figma into a HyperFrames video - rendered assets, brand tokens, components, storyboard frames as reconstructed motion (frames read as states, not slides), shaders and connector-assisted motion. Use when the person pastes a figma.com link or asks to use a Figma design, frame, logo or brand.

Package
2 files, 11 KB
SKILL.md
882 words, 6 sections
Code
JavaScript (1)

SKILL.md covers: Figma → HyperFrames · Access · Commands · Motion (connector) · Shaders · Storyboards: frames are KEYFRAMES, not slides

Findings

CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: from "node:child_process"

scripts/verify-motion.mjs:24

import { execFileSync, spawnSync } from "node:child_process";
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
CRITICAL Node.js child_process module usage for shell command execution Command Injectionstatic

Pattern detected: spawnSync(

scripts/verify-motion.mjs:113

const r = spawnSync("ffmpeg", ["-i", a, "-i", b, "-lavfi", "psnr", "-f", "null", "-"], {
Remediation: Avoid child_process. If required, use execFile with explicit arguments instead of exec with shell strings
INFO Skill does not specify a license Policy Violationstatic

Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.

SKILL.md

Remediation: Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)

What is in the package

FileKindSize
SKILL.mddoc6.0 KB
scripts/verify-motion.mjsscript4.9 KB

Environment variables referenced

BAD_TOKEN FIGMA_TOKEN

Package contents recorded 2026-10-22 at commit 4371981b740d. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills