figma
Pass
Audited by Gen Agent Trust Hub on Jun 30, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill serves as a legitimate technical guide for design-to-code workflows, containing no malicious patterns.
- [CREDENTIALS_UNSAFE]: The provided code snippets correctly utilize environment variables (process.env.FIGMA_ACCESS_TOKEN) for managing API credentials, avoiding the risk of hardcoded secrets.
- [EXTERNAL_DOWNLOADS]: The skill interacts with the official Figma REST API (api.figma.com) and references the established @anthropic-ai/sdk package.
- [COMMAND_EXECUTION]: Included scripts perform standard network operations and data processing required for the intended functionality of syncing design tokens.
- [PROMPT_INJECTION]: The skill defines an ingestion pipeline from local JSON files (tokens/**/*.json) to the Figma API via fetch calls. While this represents a data ingestion surface, it does not include instructions intended to override agent behavior or bypass safety filters. Boundary markers are absent in the snippets, and sanitization is limited to type-specific parsing (hex-to-RGB and floats).
Audit Metadata