Stupid Specs
Low riskIndependent Review
Generates on-canvas annotation overlays showing a selected layer's properties, tokens, and styles for free Dev Mode inspection.
- Platform
- Figma
- Category
- Development / Dev Mode / Handoff
- Developer
- Tuxu
- Pricing
- Free
- Official website
- www.figma.com
Review summary
Installed and ran the plugin in a disposable Figma file. It only reads the currently selected layer and draws annotation frames on the canvas — no accounts, no paywall, no external calls. Live network capture during use showed only figma.com contacted.
Privacy overview
What this plugin can access and where data may go. “Unknown” means we have not verified it — not that it is safe or unsafe.
- Data accessed
- Selected layer only (name, type, size, color, style, and token values)
- Permissions requested
- Current page read/write
- Selection access
- External services
- None observed
- External APIs
- None observed
- Database connections
- None — annotations are written directly to the canvas as Figma layers
- Authentication
- None
- Cloud storage
- None observed
- Analytics
- None observed
- AI providers
- None observed
- Telemetry
- None observed
- Cookies
- Not applicable — runs inside the Figma app, not a web page
Risk assessment
- Risk level
- Low risk
- Why this risk exists
- The plugin can read the properties of whatever layer is selected and adds annotation layers to the file. Figma's manifest declares no network access, and live testing confirmed no outbound calls.
- Mitigation
- None needed — safe for use on any file, including confidential ones.
- Confidence
- Medium — live network traffic captured during a full run-through (Inspect, Add Spec, Settings, "Premium" tab); no source code review performed.
Review methodology
- Tests performed
- Figma "Data security" self-assessment disclosure
- Figma "No network access" platform badge
- Live install in a disposable Figma test file
- Full click-through: Inspect, Add Spec, Settings, "Premium" tab
- Network traffic capture during the entire session
- Evidence
- Figma's Data security modal (developer's self-reported answers)
- Figma's "No network access" panel ("The plugin cannot access any domains")
- Network request log for the test session — only www.figma.com contacted
- Screenshot: "Premium" tab is a thank-you message, not a paywall
- Known limitations
- No manifest.json or source code review performed
- Single test session — not repeated across versions
- Only a basic rectangle layer was tested, not complex node types
- Reviewer
- AI Agent supervised by a human
Read more about how we review and what Verified, Observed, Inferred and Unknown mean.
Review timeline
- Initial review published