分析Figma设计文件，提取设计系统数据（颜色、字体、间距、组件），导出截图，并与实际实现进行比对验证。使用JavaScript/Node.js实现，当用户需要处理Figma设计文件、提取设计规范、导出设计资源或验证设计实现时使用此技能。

What to check before installing/use: - Required token: SKILL.md and the code require FIGMA_ACCESS_TOKEN but the registry metadata did not declare this. Expect to provide a Figma personal access token. - Token safety: Treat that token like a secret — create a token with minimal access, run the tool in an isolated environment, and revoke it if you are unsure. The token lets the skill read files accessible to your Figma account. - Local file reads/writes: The compare command reads arbitrary local file paths you supply; do not pass sensitive system files. The skill writes exports/reports into figma-exports/ under the process CWD. - Network behavior: All network calls go to api.figma.com (expected). If you see any other network endpoints in a future version, investigate before use. - Code review & dependency audit: The source is present — review the modules for any unexpected behavior and run npm audit on dependencies before installing. Running in a disposable container or VM is recommended for first use. - Metadata mismatch: Because the registry metadata omitted the required env var, consider asking the publisher to correct the skill manifest or only use the repository after verifying the code. If you are comfortable with these points and grant only the FIGMA token you intend to use, the implementation otherwise appears consistent with its stated purpose.

Type: OpenClaw Skill Name: figma-design-analyzer Version: 1.0.2 The bundle is a legitimate utility for analyzing Figma design files, extracting design tokens (colors, fonts, spacing), and comparing them against CSS implementations. It uses the official Figma REST API (api.figma.com) and requires a user-provided FIGMA_ACCESS_TOKEN. The code logic in scripts/modules/ is consistent with the stated purpose, and there is no evidence of data exfiltration to third-party domains, obfuscation, or malicious command execution. While there are minor security risks typical of CLI tools (such as potential path traversal if a user provides a malicious output path in figma-cli.js or XSS in the generated HTML report in design-comparator.js), these appear to be unintentional vulnerabilities rather than intentional malice.