Interact with Figma files to read structure, export layers as images, and retrieve comments using the Figma REST API with authentication.

This skill appears to do what it claims, but take normal precautions: only install from trusted sources; supply a Figma PAT with the minimum required scope and rotate it if you stop using the skill; run exports in a safe/isolated working directory (the tool writes files to CWD); be aware the script will download image URLs returned by the Figma API (so inspect logs or filenames if you worry about unexpected hosts); and review the included script before use if you want to verify there are no changes beyond read-only API calls.

Type: OpenClaw Skill Name: kai-tw-figma Version: 1.0.3 The OpenClaw AgentSkill for Figma is classified as benign. The skill's code (`scripts/figma_tool.py`) and documentation (`SKILL.md`, `README.md`) clearly outline its purpose: interacting with the Figma REST API to read file structures, retrieve comments, and export assets. It uses `argparse` for robust command-line argument parsing, mitigating direct shell injection vulnerabilities from user input. The `FIGMA_TOKEN` is handled securely via environment variables, and all network communication is directed to the official Figma API. The `README.md` explicitly addresses security concerns and clarifies that the skill only performs read-only operations on Figma files and does not interact with unrelated system files or arbitrary endpoints. There is no evidence of intentional data exfiltration, persistence mechanisms, or malicious prompt injection attempts against the agent.