figma-automation
Pass
Audited by Gen Agent Trust Hub on Oct 8, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the user to add an external MCP server endpoint (
https://rube.app/mcp). While this is the standard setup for the Rube platform, it routes agent tool execution through a third-party gateway. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external Figma design files and user comments, which could be used to influence agent behavior if the content contains instructional text.
- Ingestion points: Data is ingested from the Figma API via tools such as
FIGMA_GET_FILE_JSON,FIGMA_GET_FILE_NODES, andFIGMA_GET_COMMENTS_IN_A_FILE(documented in SKILL.md). - Boundary markers: The instructions do not specify any delimiters or safety prompts to ensure the agent distinguishes between design data and system instructions.
- Capability inventory: The skill possesses the ability to read design files, extract tokens, list comments, and export assets based on the fetched data.
- Sanitization: There is no evidence of sanitization or filtering applied to the strings retrieved from Figma before they are processed by the agent.
Audit Metadata