figma-sync

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the required runtime workflows, scripts/figma_pull.py calls api_get() to ingest Figma file/node JSON (including document.characters for TEXT) from GET https://api.figma.com/v1/files/{key} or GET https://api.figma.com/v1/files/{key}/nodes, meaning outsider-authored free text can enter the system via the referenced Figma file content.