figma-canvas-authoring
Pass
Audited by Gen Agent Trust Hub on Sep 28, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill implements a restricted 'Canvas HTML' dialect for Figma design, which acts as a sandbox for document changes. It requires a mandatory preflight check for all markup trees to ensure they adhere to strict structure and size limits before execution.
- [SAFE]: Asset acquisition and research tasks are performed through controlled delegation patterns. The instructions explicitly state that workers (scouts) cannot choose direction or mutate the canvas, and the main agent must verify all external findings against the live document state before integration.
- [SAFE]: Network operations are limited to standard design asset retrieval (e.g., images and icons) through defined tool paths. The skill provides clear guidelines for establishing usage rights and content fidelity, preventing the unauthorized exfiltration of sensitive data.
- [SAFE]: No obfuscation, dynamic code execution, or persistence mechanisms were detected. The skill maintains transparency in its tool calls and configuration metadata.
Audit Metadata