figma-capture
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill fetches a capture script (
capture.js) frommcp.figma.com. This domain belongs to Figma, which is a well-known service provider, and the download is required for the skill's core functionality. - [REMOTE_CODE_EXECUTION]: The skill instructs the agent to inject and execute the externally fetched
capture.jsscript within the browser's context. This is a standard method for browser-based automation tools to access DOM elements for capture. - [PROMPT_INJECTION]: The skill processes user-supplied data via the
$ARGUMENTSvariable to determine the capture target (URL or CSS selector). While this provides an entry point for untrusted data, it is limited to the scope of browser navigation and CSS selection for the intended capture functionality.
Audit Metadata