figma-to-static
What this skill does
Convert Figma design files to pixel-level mobile-first static HTML/CSS pages
github/leoyeai - Privilege Escalation - 2.1k stars
Threat analysis
Skill info
pkg:github/LeoYeAI/openclaw-master-skills@e5199b5?skill=figma-to-staticAssessments (6)
Privilege Escalation
Privilege Escalation via skillspector
SKILL.md
credentials.jsonPrivilege Escalation via skillspector
references/figma-mcp-usage.md
credentials.jsonPrivilege Escalation via skillspector
scripts/fetch_figma_mcp.py
credentials.jsonData Exfiltration
Data Exfiltration via local-llm-review
scripts/fetch_figma_mcp.py
MCP_URL = "https://mcp.figma.com/mcp"Tool Misuse
Tool Misuse via skillspector
scripts/auth_session_guard.py
subprocess.run(
command,
shell=TrueDangerous Code Execution
Dangerous Code Execution via skillspector
scripts/auth_session_guard.py
return subprocess.run(
command,
shell=True,
stdout=subprocess.PIPE,
stderr=subprocess.STDOUT,
text=True,
check=False,
).stdoutBadge
Add the Anomity scan badge for figma-to-static to your README.
How Anomity governs this at runtime
Scan-time vetting tells you what a skill says it will do. Anomity's Endpoint Sensor sees what agents actually do: it discovers skills alongside every other AI artifact on the endpoint, and runtime governance can allow, deny, or log the tool calls a skill triggers. Policy violations route to your SIEM, Slack, email, or Jira, backed by a queryable 90-day audit trail.
Book a 30-minute demo to see your own skill inventory.
Methodology and disputes
Every skill is assessed by the Anomity Skill Intelligence engine against its public source; findings indicate risk patterns, not confirmed exploitation. Maintainer of figma-to-static? Report an issue or request a rescan.
