claude-code-design-ai
Warn
Audited by Snyk on May 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The SKILL.md explicitly shows importing and fetching user-generated Figma content (see the "Figma to React Conversion" example using FigmaImporter.fetchNode(fileKey, nodeId) with a FIGMA_ACCESS_TOKEN), which the agent ingests and interprets to generate components and workflows—allowing untrusted third-party content to materially influence subsequent code-generation actions.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata