Announcing Beacon: Self-improving memory for coding agents
← All skills
Skill

figma-use-figjam

skill:openai/plugins#figma-use-figjam

This skill helps agents use Figma's use_figma MCP tool in the FigJam context. Can be used alongside figma-use which has foundational context for using the use_figma tool.

Verdict
Suspicious

Risky behavior the analysis could not rule out.

Analyzed Oct 27, 2026, 22:53 UTC at 0722921

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

1
findings
medium
highest severity
1
threat classes
5,479
files scanned
2,852/2,852
checks satisfied
0
package advisories

Why this verdict

  • suspicious: finding skill:plugins/figma/skills/figma-use-figjam:plugins/figma/skills/figma-code-connect/references/api.md:541:SUPPLY

Security findings 1

Supply chain

mediumContextual risklow confidence

Installation docs instruct the agent to globally install the @figma/code-connect CLI from npm at the unpinned @latest tag, downloading and executing remote code whose version is not pinned; the vendor-documented origin makes this a plausible-but-unverified supply risk rather than established abuse.

npm install --global @figma/code-connect@latest
vector:instruction
Counter-argument considered

The fenced install command is exactly as claimed, and the registry-install carve-out requires a pinned version while @latest is unpinned, so the behavior is not carved out; no shown declared claim covers installing the code-connect CLI, and the command is a concrete agent-executable instruction.

Open questions 7

What the analysis could not settle from the code alone.

Ten PY-CLAIM-CONTRADICTION detector leads cite the claim 'Name it ComponentName.figma.ts — never ComponentName.figma.tsx' and contrast it with file writes, but that claim text appears in none of the shown units (the cited spans contain only ordinary Figma workflow content, and excerpts like 'Register' or 'c.name' are ordinary code-example text); the file and lines actually containing the naming claim could not be located in the evidence shown, so the alleged contradiction could not be confirmed ⟦… 11 more chars …⟧
Persistence
Five PY-CLAIM-CONTRADICTION detector leads (DET:e46ccf32fbaf0f4f, DET:096743a2acfe43a5, DET:8b77940a7c82d9e0, DET:db1d9e5cd8269c1f, DET:fb65308ea2db4dc3) cite a 'Name it ComponentName.figma.ts — never ComponentName.figma.tsx' claim contradicted by a file_write, but the text of every cited unit (token-creation.md 755-784 and 785-820, SKILL.md 38-41, create-connector.md 321-332) contains neither that claim nor any file write; is such a claim/file-write pair present elsewhere in the artifact, or ar⟦… 55 more chars …⟧
Persistence
Seven PY-CLAIM-CONTRADICTION detector leads (DET:56684cc941fc788e, DET:25ef715a9b6e2514, DET:bd9027fa8bc7c126, DET:2dd025f87461f3a9, DET:9c1d8f8a831c7fdc, DET:31ad2c3385fb925b, DET:3811b7e0d357610a) cite a claim 'Name it `ComponentName.figma.ts` — never `ComponentName.figma.tsx`.' at specific lines of create-label.md, create-section.md, create-shape-with-text.md, create-sticky.md, create-table.md, create-text.md, and edit-text.md, but the shown content at those cited lines and spans contains onl⟦… 234 more chars …⟧
Persistence
The unit asserts the use_figma `skillNames` parameter is 'a logging parameter used to track skill usage — it does not affect execution'; whether the parameter has any effect beyond logging cannot be verified from the artifact's own content.
Tool poisoning
Detector lead DET:eba9ff739b9f558a (PY-CLAIM-CONTRADICTION, PERSIST) claims line 55 of wwdc-variables.md contains a file-naming rule ('Name it ComponentName.figma.ts — never ComponentName.figma.tsx') contradicted by a file_write, but the shown unit SRC:32e94717c9b7ece7 covering lines 50-56 contains only Figma API gotchas (createVariableCollection, duplicate names, variable aliases, setValueForMode) and no such claim and no file write; the contradiction cannot be confirmed from the evidence shown⟦… 1 more chars …⟧
Persistence
All 19 reviewed units are excerpts of the sibling figma-use skill's TypeScript declaration file (plugins/figma/skills/figma-use/references/plugin-api-standalone.d.ts) rather than files under the figma-use-figjam target root; whether figma-use-figjam ships or instructs loading additional executable content is not shown in this pass. The reviewed content itself is vendor Figma Plugin API documentation (node styling, layout, variables, payments, client storage, exports) with no source-to-sink chain⟦… 205 more chars …⟧
Detector lead DET:eba9ff739b9f558a (PY-CLAIM-CONTRADICTION, class PERSIST) claims that wwds-variables.md line 55 contains a 'ComponentName.figma.ts' naming claim contradicted by a file write, but the shown span of SRC:32e94717c9b7ece7 (lines 50-56, 'Common gotchas') contains only Figma variable API gotchas with no such claim and no file write; the lead cannot be confirmed against the cited content and appears stale or misaligned. No harmful behavior is established from the evidence shown.
Persistence
Refuted findings 5

Candidates the review stage examined and rejected, kept for transparency.

Tool poisoning

criticalRefutedlow confidence

The figma-generate-design skill body instructs the agent, on every use_figma call made under this skill, to inject a fixed skill-name value (with a resource: prefix when loaded via MCP resource) into the skillNames parameter of another MCP tool, conditioning that tool's parameter; it plausibly reflects the vendor's own logging convention and routes no user data.

Always include `figma-generate-design` in the comma-separated `skillNames` parameter when calling `use_figma` as part of this skill.
Why it was refuted

The skillNames value is a constant self-identifier for the vendor's own tool with no user-data flow, and the same sentence openly declares the parameter as logging-only (extracted as declared claim D33), so the behavior is declared core tool-usage guidance, not undeclared tool poisoning.

Tool poisoning

criticalRefutedlow confidence

The slides skill text instructs the agent, whenever it calls the use_figma tool, to always populate another tool's skillNames parameter with this skill's name (conditionally prefixed with resource:), conditioning how another tool's parameter is filled; the claimed logging-only purpose cannot be verified from the artifact.

Always include `figma-use-slides` in the comma-separated `skillNames` parameter when calling `use_figma` for Slides operations.
Why it was refuted

The instruction only fixes the skill's own constant name in the companion tool's parameter and is openly declared in the same sentence as a logging parameter (extracted as declared claim D200), so the undeclared-conditioning allegation fails and the fixed value routes no data.

Tool poisoning

criticalRefutedmedium confidence

The skill body instructs the agent to always populate the use_figma tool's skillNames parameter with 'figma-use' (or 'resource:figma-use' when loaded via MCP resource), conditioning a companion tool's parameter from artifact text with an unverifiable self-description as logging-only.

Always include `figma-use` in the comma-separated `skillNames` parameter when calling `use_figma`
Why it was refuted

The skill body states the skillNames requirement verbatim and self-describes it as logging-only (extracted as declared claim D243), and the injected value is a fixed skill name with no data flow or execution effect, so this is declared usage guidance rather than undeclared tool poisoning.

Tool poisoning

criticalRefutedmedium confidence

The figma-use skill frontmatter conditions every use_figma tool call on first loading this skill, forcing its instructions into the agent's context before any use of the companion tool (trigger: before every use_figma call; action: invoke skill; justification: avoiding hard-to-debug failures).

you MUST invoke this skill BEFORE every `use_figma` tool call. NEVER call `use_figma` directly without loading this skill first
Why it was refuted

The quoted conditioning is the skill's own frontmatter trigger description — the declaration itself, with the decoded unit matching the surface text so nothing is concealed — and pre-loading injects only the artifact's own guidance without manipulating any tool parameter or routing data, so the behavior is declared and harmless.

Persistence

criticalRefutedlow confidence

The skill text instructs the reader (agent) to write snippet documentation to disk at an unspecified location for future reuse, steering toward untracked file writes outside the declared Figma-task scope.

call them out and write to disk so you can reuse in the future
Why it was refuted

The sentence directs only documentation-snippet note-taking with no path, payload, or execution, and it is extracted verbatim as declared capability claim D266 (kind=capability, topic=file_write, descriptive), so the behavior is declared rather than undeclared persistence outside scope.

Coverage gaps 14

Parts of the artifact the static analysis could not fully examine.

context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/helpers.mjs.br.part-000
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-arm64/unix.node
context:unanalyzable_binary macho content is only byte-scanned
plugins/codex-security/mcp/native/darwin-x64/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-arm64-musl/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-gnu/unix.node
context:unanalyzable_binary elf content is only byte-scanned
plugins/codex-security/mcp/native/linux-x64-musl/unix.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-arm64/windows.node
context:unanalyzable_binary pe content is only byte-scanned
plugins/codex-security/mcp/native/win32-x64/windows.node
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-000
context:unanalyzable_binary binary content is only byte-scanned
plugins/codex-security/mcp/server.mjs.br.part-001
context:oversize archive member exceeds 8388608 bytes; truncated, no text
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json
context:decoded_views_exceeded 452 derived view(s) beyond the per-file view cap: decoded:charcode, decoded:rot13, decoded:unicode-escape
plugins/creative-production/mcp/server.bundle.mjs
context:bytes_unavailable yara-x: no bytes to scan
plugins/shopify/skills/shopify-admin/assets/admin_2026-04.json.gz!/admin_2026-04.json