registry / figma-claw / 2.0.2

figma-claw@2.0.2

CLI tooling for Figma workflows.

AI Security Review

scanned 4d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. No install-time attack behavior was found. The main residual risk is explicit `figma-claw setup` installing a first-party bundled skill into Codex/Claude skill directories.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs figma-claw setup, login, export, screenshot, session, or control commands

Impact

Can write exported artifacts, screenshots, storage state, session metadata, and bundled skill files when invoked by the user; no confirmed malicious exfiltration path.

Mechanism

CLI-driven Playwright/Figma automation and first-party agent skill installation

Rationale

Because the package explicitly mutates Codex/Claude skill directories only via `figma-claw setup`, this fits first-party agent extension lifecycle risk rather than malware. Source inspection found no unconsented install hook, secret harvesting, stealth persistence, or remote code execution chain.

Evidence

package.jsondist/cli.jsREADME.mdskills/figma-implement-ui/SKILL.md~/.codex/skills~/.claude/skills~/.playwright/figma-claw/figma-storage-state.json.artifacts/figma.artifacts/playwright-screenshots

Network endpoints4

www.figma.com/loginwww.figma.com/design/FILE_KEY/Example127.0.0.1:3000placehold.co

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

dist/cli.js setup command copies bundled skills into ~/.codex/skills and ~/.claude/skills
dist/cli.js setup may spawn `pnpm exec playwright install chromium` when Chromium is missing
dist/cli.js login accepts --email/--password and saves Playwright storage state by explicit user command

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks
Network/browser activity is CLI-invoked and aligned with Figma/Playwright workflow
No static evidence of credential exfiltration or remote payload execution
Agent skill content is Figma UI implementation guidance, not prompt hijacking or secret harvesting
Child process use is limited to documented setup/install and session CLI behavior

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 1 file(s), 498 KB of source, external domains: 127.0.0.1, github.com, goo.gl, placehold.co, www.figma.com

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{createRequire as e}from"node:module";import{existsSync as t,realpathSync as n}from"node:fs";import r,{resolve as i}from"node:path";import{fileURLToPath as a}from"node:url";import{spawn as o}from"node:child_process";import{cp as s,mkdir as c,mkdtemp as l,readFile as u,readdir as d,rm as f,stat as p,writeFile as m}from"node:fs/promises";import{homedir as h,platform as g,tmpdir as _}from"node:os";import v,{randomUUID as y}from"node:crypto";import b from"node:http";import x from"node:net";import{WebSocketServer as S}from"ws";var C=Object.create,w=Object.defineProperty,T=Object.getOwnPropert ...

3`)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandText(e):e[0]===`[`||e[0]===`<`?this.styleArgumentText(e):this.styleCommandText(e)).join(` `)}styleCommandDescription(e){return this.styleDescriptionText(e)}styleOptionDescription(e){return this.styleDescriptionText(e)}styleSubcommandDescription(e){return this.styleDescriptionText(e)}styleArgumentDescription(e){return this.styleDescriptionText(e)}styleDescriptionText(e){return e}styleOptionTerm(e){return this.styleOptio ...

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

4`+` `.repeat(t+2)),i+a+` `.repeat(2)+s.replace(/\n/g,`\n${i}`)}boxWrap(e,t){if(t<this.minWidthToWrap)return e;let n=e.split(/\r\n|\n/),r=/[\s]

5`)}};function r(e){return e.replace(/\x1b\[\d*(;\d*)*m/g,``)}e.Help=n,e.stripColor=r})),M=k((e=>{let{InvalidArgumentError:t}=j();var n=class{constructor(e,t){this.flags=e,this.description=t||``,this.required=e.includes(`<`),this.optional=e.includes(`[`),this.variadic=/\w\.\.\.[>\]

6- a short flag is a single dash and a single character

7 - either use a single dash and a single character (for a short flag)

8 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):r.test(t)?Error(`${n}

9- too many short flags`):i.test(t)?Error(`${n}

10- too many long flags`):Error(`${n}

11- unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOptions=r})),ie=k((e=>{function t(e,t){if(Math.abs(e.length-t.length)>3)return Math.max(e.length,t.length);let n=[];for(let t=0;t<=e.length;t++)n[t]=[t];for(let e=0;e<=t.length;e++)n[0][e]=e;for(let r=1;r<=t.length;r++)for(let i=1;i<=e.length;i++){let a=1;a=e[i-1]===t[r-1]?0:1,n[i][r]=Math.min(n[i-1][r]+1,n[i][r-1]+1,n[i-1][r-1]+a),i>1&&r>1&&e[i-1]===t[r-2]&&e[i-2]===t[r-1]&&(n[i][r]=Math.min(n[i][r],n[i-2][r-2]+1))}return ...

12- specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerCommand(e),e.parent=this,e._checkForBrokenPassThrough(),this}createArgument(e,t){return new o(e,t)}argument(e,t,n,r){let i=this.createArgument(e,t);return typeof n==`function`?i.default(r).argParser(n):i.default(n),this.addArgument(i),this}arguments(e){return e.trim().split(/ +/).forEach(e=>{this.argument(e)}),this}addArgument(e){let t=this.registeredArguments.slice(-1)[0];if(t?.variadic)throw Error(`only the last argument ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

13Expecting one of '${n.join(`', '`)}'`);return this._lifeCycleHooks[e]?this._lifeCycleHooks[e].push(t):this._lifeCycleHooks[e]=[t],this}exitOverride(e){return e?this._exitCallback=e:this._exitCallback=e=>{if(e.code!==`commander.executeSubCommandAsync`)throw e},this}_exit(e,t,n){this._exitCallback&&this._exitCallback(new c(e,t,n)),a.exit(e)}action(e){let t=t=>{let n=this.registeredArguments.length,r=t.slice(0,n);return this._storeOptionsAsProperties?r[n]=this:r[n]=this.opts(),r.push(this),e.apply(this,r)};return this._actionHandler=t,this}createOption(e,t){return new d(e,t)}_callParseArg(e,t,n,r ...

14- already used by option '${t.flags}'`)}this._initOptionGroup(e),this.options.push(e)}_registerCommand(e){let t=e=>[e.name()].concat(e.aliases()),n=t(e).find(e=>this._findCommand(e));if(n){let r=t(this._findCommand(n)).join(`|`),i=t(e).join(`|`);throw Error(`cannot add command '${i}' as already have command '${r}'`)}this._initCommandGroup(e),this.commands.push(e)}addOption(e){this._registerOption(e);let t=e.name(),n=e.attributeName();if(e.negate){let t=e.long.replace(/^--no-/,`--`);this._findOption(t)||this.setOptionValueWithSource(n,e.defaultValue===void 0?!0:e.defaultValue,`default`)}else e ...

15- either make a new Command for each call to parse, or stop storing options as properties`);this._name=this._savedState._name,this._scriptPath=null,this.rawArgs=[],this._optionValues={...this._savedState._optionValues},this._optionValueSources={...this._savedState._optionValueSources},this.args=[],this.processedArgs=[]}_checkForMissingExecutable(e,t,n){if(i.existsSync(e))return;let r=`'${e

16 - if '${n}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

17 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

18 - ${t?`searched for local subcommand relative to directory '${t}'`:`no directory for search for local subcommand, use .executableDir() to supply a custom directory`}`;throw Error(r)}_executeSubCommand(e,t){t=t.slice();let o=!1,s=[`.js`,`.ts`,`.tsx`,`.mjs`,`.cjs`];function l(e,t){let n=r.resolve(e,t);if(i.

19`),this.outputHelp({error:!0}));let n=t||{},r=n.exitCode||1,i=n.code||`commander.error`;this._exit(r,i,e)}_parseOptionsEnv(){this.options.forEach(e=>{if(e.envVar&&e.envVar in a.env){let t=e.attributeName();(this.getOptionValue(t)===void 0||[`default`,`config`,`env`].includes(this.getOptionValueSource(t)))&&(e.required||e.optional?this.emit(`optionEnv:${e.name()}`,a.env[e.envVar]):this.emit(`optionEnv:${e.name()}`))}})}_parseOptionsImplied(){let e=new f(this.options),t=e=>this.getOptionValue(e)!==void 0&&![`default`,`implied`].includes(this.getOptionValueSource(e));this.options.filter(n=>n.impl ...

20Expecting one of '${n.join(`', '`)}'`);let r=`${e}Help`;return this.on(r,e=>{let n;n=typeof t==`function`?t({error:e.error,command:e.command}):t,n&&e.write(`${n}\n`)}),this}_outputHelpIfRequested(e){let t=this._getHelpOption();t&&

21`))},\n],`:`${e}: ${typeof t==`number`?B(t):t},`),i=(n||[]).map(e=>typeof e==`number`?B(e):e).join(`, `),a=r.join(` `);return a.length<40&&!

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

dist/cli.jsView file

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{createRequire as e}from"node:module";import{existsSync as t,realpathSync as n}from"node:fs";import r,{resolve as i}from"node:path";import{fileURLToPath as a}from"node:url";i... L3: `)}displayWidth(e){return r(e).length}styleTitle(e){return e}styleUsage(e){return e.split(` `).map(e=>e===`[options]`?this.styleOptionText(e):e===`[command]`?this.styleSubcommandTe... ... L10: - too many long flags`):Error(`${n} L11: - unrecognised flag format`)}if(t===void 0&&n===void 0)throw Error(`option creation failed due to no flags found in '${e}'.`);return{shortFlag:t,longFlag:n}}e.Option=n,e.DualOption... L12: - specify the name in Command constructor or using .name()`);return t||={},t.isDefault&&(this._defaultCommandName=e._name),(t.noHelp||t.hidden)&&(e._hidden=!0),this._registerComman...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

Findings

2 High2 Medium5 Low

HighChild Processdist/cli.js

HighCommand Output Exfiltrationdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1

4`+` `.repeat(t+2)),i+a+` `.repeat(2)+s.replace(/\n/g,`\n${i}`)}boxWrap(e,t){if(t<this.minWidthToWrap)return e;let n=e.split(/\r\n|\n/),r=/[\s]

6- a short flag is a single dash and a single character

7 - either use a single dash and a single character (for a short flag)

8 - or use a double dash for a long option (and can have two, like '--ws, --workspace')`):r.test(t)?Error(`${n}

9- too many short flags`):i.test(t)?Error(`${n}

10- too many long flags`):Error(`${n}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L1

16 - if '${n}' is not meant to be an executable command, remove description parameter from '.command()' and use '.description()' instead

17 - if the default executable name is not suitable, use the executableFile option to supply a custom name or path

21`))},\n],`:`${e}: ${typeof t==`number`?B(t):t},`),i=(n||[]).map(e=>typeof e==`number`?B(e):e).join(`, `),a=r.join(` `);return a.length<40&&!

Long lines were clipped for display.