What the analysis could not settle from the code alone.
Detector leads DET:4e199732278d406f, DET:ff61b57d360db5dd, DET:c7ac7472ad2e4552, and DET:cb69f253bd73d1a3 cite the claim 'Scopes on every variable — NEVER leave as ALL_SCOPES' as contradicted by figma.com URLs; that claim text is not present in any shown unit, and the cited URLs are documentation examples for URL parsing, so no exfiltration behavior is confirmable from this batch.
Data exfiltration
Detector leads DET:8c54f1774a4f84e7, DET:41ad41365338c4d8, DET:b69f850bd5decf8c, DET:c8f1dac09bffda2f, DET:0b16492799249724, and DET:81e953c41c915213 pair the '.figma.ts never .figma.tsx' naming rule with file_write hits ('${content}', 'boolean,', '}'); the cited content is inline documentation code examples inside markdown fences, not writes performed by the artifact, so no contradiction or persistence behavior is confirmable here.
Persistence
Detector leads (PY-CLAIM-CONTRADICTION) attribute a '.figma.ts never .figma.tsx' naming claim to line spans whose shown unit text (button-label example 'Register', JS property reads like p.name/c.name, and code-connect snippets) contains no such claim or file write; the leads fail verification against the shown content, so no contradiction finding is reported.
The target skill is figma-use-slides (Slides context), but every owed unit is a figma-generate-library reference that explicitly states its snippets target Figma Design files and that figma.createPage() throws in Slides; confirm whether figma-use-slides actually loads these Design-file-only references and whether this context mismatch is intentional.
Detector lead DET:b1db792e42b4d5ba claims a contradiction in error-recovery.md line 337 ('Name it ComponentName.figma.ts — never ComponentName.figma.tsx' vs file_write 'n.type'), but the shown text of SRC:b6d03c2e2652e6b3 contains neither the claimed text nor any file write; is the lead a false positive?
Detector leads DET:e46ccf32fbaf0f4f, DET:096743a2acfe43a5, DET:8b77940a7c82d9e0, and DET:739ad3528b6b36aa (rule PY-CLAIM-CONTRADICTION, class PERSIST) cite a claim 'Name it `ComponentName.figma.ts` — never `ComponentName.figma.tsx`.' contradicted by a file_write, but the shown text of units SRC:cdc9ad01cb446178, SRC:886b75169036cb22, and SRC:a9f6d329a51bff9f at the cited lines contains neither that claim nor any file write, so the leads could not be confirmed against the evidence shown.
Persistence
Shipped reference documentation contains a concealed HTML-comment TODO addressed to a developer ('Before production launch, fix NODE_TYPES_BLOCKED_IN_SLIDES in share/plugin-api/src/api/constants.ts ... Remove this limitation note once fixed'), revealing internal source paths; confirm whether HTML-comment channels in these reference files carry any agent-directed instructions or additional concealed content beyond this benign dev note.
The target root is plugins/figma/skills/figma-use-slides but all 112 owed units are sections of plugins/figma/skills/figma-use/references/*.md; confirm the slides skill intentionally loads the figma-use reference docs rather than these units being attached to the wrong target. No instruction-surface violation was found in any shown unit regardless.
Detector leads DET:4a63fa73322de685, DET:70830751d2a0f24e, DET:dcaeacc69ae9bb47, DET:d6f961d8a0a921e2, DET:a0d107c2b2b3c627, DET:9d5bba064b98d146, and DET:afaaef5ea8ed42b0 cite a claim about '.figma.tsx' naming at lines 319/421-423/457/471/674 of gotchas.md, but the cited units' shown text (SRC:8c8d6cad4e118ad4 lines 317-346, SRC:e5c8cc235e389ec9 lines 413-472, SRC:e83d014ed634c243 lines 670-695) contains no such claim; the leads could not be confirmed and no finding was raised from them.
Detector leads DET:31db6c8f062ad1a6/DET:b99365aadbf68822/DET:6ec0d8e4c6d90d98/DET:7ae6eb229a6cd70b cite a claim about naming files 'ComponentName.figma.ts' that does not appear in the cited unit SRC:3d0d56f708bc2a47 (lines 115-142 show only the VariablesAPI reference table); the '←' excerpt matches markdown annotation arrows ('← preferred; sync deprecated'), not a file_write directive, so the leads are unconfirmed and produce no finding for this pass.
Detector lead DET:eba9ff739b9f558a (PERSIST) reports a claim 'Name it `ComponentName.figma.ts` — never `ComponentName.figma.tsx`' contradicted by a file_write at wwds-variables.md:55, but the shown lines 50-56 of that file contain only variable gotchas (createVariableCollection, duplicate names, aliases, setValueForMode) with no such claim and no file_write; the lead could not be verified against the cited content and no finding was raised from it.
Persistence
Can contradiction leads C18-C20 (DET:e46ccf32fbaf0f4f, DET:096743a2acfe43a5, DET:8b77940a7c82d9e0), which claim an instructed file_write '0' at token-creation.md lines 781 and 819 breaking claims D6-D300, be confirmed? The cited units contain only read-only Figma validation scripts (getLocalVariableCollectionsAsync/getLocalVariablesAsync/return summary) and instructions to re-run Figma variable scope/code-syntax scripts; no file write instruction is visible, and the '0' excerpt matches literal '⟦… 104 more chars …⟧
Three PY-CLAIM-CONTRADICTION detector leads (DET:141b0029238dbdbc, DET:6d287761bd05442d, DET:b1db792e42b4d5ba) cite a 'Name it ComponentName.figma.ts — never .tsx' claim contradicted by file writes 'c.name'/'n.type', but the cited unit spans contain no such claim and no file-write code: the cited lines hold a print of node names and a node-type filter within the Figma API, so the leads could not be confirmed as any host-side persistence or write behavior.
Persistence
The ten PY-CLAIM-CONTRADICTION detector leads cite a 'ComponentName.figma.ts' naming claim and file_write/network excerpts (e.g. 'example.com', 'n.type', 'TEXT') that do not appear as the claimed text or as any write/network behavior in the cited unit content; verified examples are benign (the example.com occurrence documents unsupported markdown link syntax in speaker notes, and no fetch exists). Confirm whether the full source files contain any plugin-code write or network instruction supporti⟦… 15 more chars …⟧
Ten PY-CLAIM-CONTRADICTION detector leads (class PERSIST) cite a claim about naming files 'ComponentName.figma.ts' being contradicted by file_write values, but that claim text does not appear in any cited unit's shown line ranges (the cited spans contain only Figma API usage guidance such as the pre-flight checklist, 'What Does NOT Work' table, and text-edit recipes), so the leads could not be confirmed against the shown content.
[file request plugins/figma/skills/figma-use/SKILL.md] figma-generate-design mandates loading figma-use before any use_figma call; does figma-use SKILL.md contain directives that steer the agent beyond the declared Figma task?
Agent hijacking
