wds-6-asset-generation

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest external project data—specifically 'Page Specifications', 'Trigger Maps', and 'Design System' files (e.g., in output_folder/C-Scenarios/ and docs/D-Design-System/)—to drive prompt generation for asset creation and tool calls to Figma.
  • Ingestion points: Project specifications (.md), Trigger Maps (.md), and Design System tokens (.md/.yaml) located in the configured project output folder.
  • Boundary markers: The skill employs a disciplined multi-model framework (the 'Content Creation Workshop') that uses structured YAML blocks for data synthesis and refinement, which acts as a structural boundary.
  • Capability inventory: The skill invokes MCP tools like mcp2_import-html to inject generated HTML/CSS into Figma and performs file writes to the {output_folder}/E-Assets/ directory.
  • Sanitization: The workflow includes a 'Generate and Validate' step (step-04-generate-validate.md) that checks HTML structure, styling compatibility (e.g., hex conversion, pixel mapping), and content completeness before tool execution.
  • [EXTERNAL_DOWNLOADS]: The documentation and integration guides (data/mcp-server-integration.md, data/figma-mcp-integration.md) recommend the installation of external NPM packages to facilitate the Figma-to-code pipeline.
  • Packages: Recommends installing @modelcontextprotocol/server-figma and @wds/figma-mcp-server via NPM/npx.
  • Trust: These packages are part of the intended architecture for the Whiteport Design System (WDS) and the Model Context Protocol (MCP) ecosystem.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 02:12 AM