figma-typings-audit
Pass
Audited by Gen Agent Trust Hub on Aug 27, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches specific versions of the
@figma/plugin-typingspackage from the npm registry usingnpm packto facilitate a code diff between installed and target versions. - [COMMAND_EXECUTION]: Utilizes various system and development tools including
grep,npm,tar,diff, andpnpm. These are used to resolve versions, extract package contents, and perform repository maintenance tasks like linting and building. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by reading and parsing
.d.tsfiles from the downloaded Figma typings. This presents a theoretical attack surface where malicious content in the typings file could attempt to influence the agent's code implementation logic in Stage 7. - [DYNAMIC_EXECUTION]: Generates a temporary
tsconfig.probe.jsonfile at runtime in the scratch directory. This configuration is used to invoke the TypeScript compiler (tsc) to verify type safety against the new typings without modifying the main project configuration.
Audit Metadata