OpenAI Codex security directory

Figma

Published by Figma

High risk

Connects design and development workflows between Figma and application code. Implement designs, map components with Code Connect, and build screens or design systems. Also supports FigJam diagrams, slides, motion and SwiftUI translation workflows.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Deletes nodes, pages, variables, collections and slides: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Writes local code, .figma.ts templates and AGENTS.md rules: Can read, create, or change files on the local filesystem or in a selected project.
  • Creates files, diagrams, components, tokens, Code Connect mappings: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • Reads private design files, libraries, screenshots and identity/plans: Can read private account, workspace, repository, message, analytics, or file data.
  • use_figma executes agent-written JavaScript in Figma files: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Server tools that spend Figma AI / Weave credits: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 12 tools or capabilities.

  • figma-code-connect
  • figma-create-new-file
  • figma-design-to-code
  • figma-generate-design
  • figma-generate-diagram
  • figma-generate-library
  • figma-implement-motion
  • figma-swiftui
  • figma-use
  • figma-use-figjam
  • figma-use-motion
  • figma-use-slides

The interactive security report will load automatically.