github C# re-analysis due

2chevskii/FigmaMCP

Local MCP companion that connects AI clients to open Figma documents through a loopback-only Figma plugin bridge.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport stdio counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit b57f6e5 · analyzer v33 · 3d ago

dynamic code execution vm exec 2chevskii-FigmaMCP-b57f6e5/packages/plugin/tests/figma-encoding-polyfill.test.mjs :13 vm.runInNewContext(source, sandbox);
dynamic code execution vm exec 2chevskii-FigmaMCP-b57f6e5/packages/plugin/tests/helpers/load-typescript-module.mjs :18 vm.runInNewContext(result.output[0].code, sandbox, { filename: resolve(entryPoint) });

code evidence vv1.1.2 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 63

fs (weak) 2chevskii-FigmaMCP-b57f6e5/packages/plugin/scripts/build.mjs :2 import { copyFile, mkdir, readFile, writeFile } from "node:fs/promises";
fs (weak) 2chevskii-FigmaMCP-b57f6e5/packages/plugin/tests/figma-encoding-polyfill.test.mjs :2 import { readFile } from "node:fs/promises";
fs (weak) 2chevskii-FigmaMCP-b57f6e5/packages/plugin/tests/tool-parity.test.mjs :2 import { readFile } from "node:fs/promises";

shell (weak) 2chevskii-FigmaMCP-b57f6e5/packages/plugin/scripts/build.mjs :1 import { execFile, spawn } from "node:child_process";