figma-enumerate-component-urls
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONDATA_EXFILTRATIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run curl and python3 commands in a shell environment to interact with the Figma API. This pattern introduces a shell execution surface where variables like FILE_KEY and IDS are interpolated into command strings.
- [DATA_EXFILTRATION]: The skill utilizes the $FIGMA_ACCESS_TOKEN environment variable within curl headers for authenticating with Figma's official API. There is a potential risk of exfiltration if a user provides a crafted Figma URL that results in a command injection payload being extracted into the FILE_KEY variable before the shell command is executed.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes data from external Figma files (component and page names). Since this data is controlled by whoever can edit the Figma file, it could contain instructions designed to influence the agent's behavior.
- Ingestion points: Figma REST API responses (api.figma.com) containing component and page names.
- Boundary markers: Absent. The skill produces a markdown list without specific delimiters for external content.
- Capability inventory: Shell command execution (curl) and Python script execution.
- Sanitization: Absent. Component names are printed directly to standard output and then formatted by the agent.
Audit Metadata