figma — agentic threat model
This agent acts as a bridge between Claude Code and Figma via an MCP server, presenting moderate risk primarily through potential unauthorized access to proprietary design files, intellectual property, and design tokens.
OWASP AIVSS score rationale
| Autonomy of Action | 0.40 | |
| Goal-Driven Planning | 0.30 | |
| Self-Modification | 0.00 | |
| Dynamic Tool Use | 0.50 | |
| Persistent Memory | 0.20 | |
| Contextual Awareness | 0.60 | |
| Dynamic Identity | 0.30 | |
| Multi-Agent Interactions | 0.40 | |
| Non-Determinism | 0.50 | |
| Opacity & Reflexivity | 0.40 |
Scored with the canonical OWASP AIVSS formula (AIVSS calculator reference); agentic risk factors estimated from the agent’s described capabilities.
MAESTRO 7-layer threat model
Per-layer threats for this agent. Layers tagged “not certain from listing” are general, caveated commentary where the public description didn’t pin that layer.
Not certain from the listing — relies on Claude's underlying foundation models (e.g., Claude 3.5 Sonnet) which are susceptible to prompt injection, adversarial inputs, and model reprogramming to bypass design access controls.
The agent ingests Figma design files, component information, and design tokens. Threats include data exfiltration of proprietary UI/UX designs and intellectual property if the MCP server or Claude session is compromised.
Uses the Model Context Protocol (MCP) to expose Figma design-file tools to Claude. Vulnerabilities include insecure tool integration, tool misuse (e.g., unauthorized file reading), and prompt injection manipulating tool arguments.
Not certain from the listing — the deployment of the Figma MCP server (local vs. hosted) dictates the infrastructure risk, including potential exposure of local Figma API tokens or local network access.
Not certain from the listing — there is no mention of built-in guardrails, logging, or observability tools to monitor design file access or detect anomalous data extraction patterns.
Relies on Figma's API authentication (likely OAuth or Personal Access Tokens). A key risk is the lack of granular authorization, where the agent might inherit broad read/write permissions to all user files.
Operates within the Claude Code ecosystem as a plugin. Risks include cascading failures or trust abuse if another compromised Claude plugin or agent interacts with the Figma MCP server.
MAESTRO — the 7-layer agentic threat-modeling framework (Cloud Security Alliance / Ken Huang).