design-to-code
Pass
Audited by Gen Agent Trust Hub on Jun 15, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The skill instructs users to pass a Figma Personal Access Token directly as a command-line argument in the
fetch-figmacommand. This can expose the secret in shell history, process listings, and logs. - [EXTERNAL_DOWNLOADS]: The workflow requires installing the
coderiopackage from an external registry (NPM) and fetching design assets and data from Figma's servers. - [COMMAND_EXECUTION]: The skill relies on a local Node.js script (
scripts/coderio-skill.mjs) to manage the workflow, including file system operations and generating prompts for the AI. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it ingests untrusted data from Figma files (such as layer names and text content) and interpolates it into prompts used for code generation without explicit sanitization.
- Ingestion points: Data enters through the
fetch-figmacommand, which saves Figma document data toprocess/processed.json. - Boundary markers: The prompts generated in
coderio-skill.mjs(e.g., instructure-promptandprops-prompt) do not use clear delimiters or instructions to ignore malicious content embedded in the Figma data. - Capability inventory: The skill has the capability to write files to the local file system and generate executable React/TypeScript code.
- Sanitization: There is no evidence of sanitization or escaping of text content fetched from Figma before it is used in prompt construction.
Audit Metadata