figma-build
Pass
Audited by Gen Agent Trust Hub on Nov 6, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides structured guidance for designers and developers to build Figma assets using code as a source, promoting design system integrity and reuse of existing components.
- [INDIRECT_PROMPT_INJECTION]: The skill processes external code and descriptions to generate designs. While this represents an ingestion surface for untrusted data, the risk is mitigated by the specialized nature of the provided Figma tools. Evidence chain: (1) Ingestion points: User prompts, code artifacts, and UI specifications as described in SKILL.md. (2) Boundary markers: No explicit delimiters or 'ignore' instructions are provided for the ingested data. (3) Capability inventory: Includes Figma node modification tools and local file reading for asset import via import_image. (4) Sanitization: No specific input sanitization or validation of external content is defined.
- [DATA_EXFILTRATION]: No unauthorized data exfiltration or sensitive file access patterns were identified. The import_image capability documented in references/assemble-screens.md is a standard feature for legitimate asset management.
- [OBFUSCATION]: The skill files contain clear, plain-text markdown instructions and reference materials without any obfuscation, hidden URLs, or suspicious character encodings.
Audit Metadata