figma-sync
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill interacts exclusively with official Figma domains (api.figma.com) and Figma-hosted asset URLs for data retrieval.
- [SAFE]: Authentication is handled securely via the FIGMA_TOKEN environment variable, adhering to best practices for secret management.
- [SAFE]: The code generation logic in scripts/figma_pull.py includes sanitization routines that escape potentially disruptive characters (such as JSX delimiters) from design content before writing to component files.
- [SAFE]: File system interactions are restricted to the local output directory and a dedicated cache folder, with no attempts at privilege escalation or persistence.
Audit Metadata