typography-scale
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns or security vulnerabilities were identified. The skill's functionality is consistent with its stated purpose of managing typographic scales.
- [DYNAMIC_EXECUTION]: The skill contains a Python script (
scripts/scale.py) that generates JavaScript files for the Figma Plugin API. This generation process usesjson.dumps()to securely serialize variables, which prevents code injection attacks in the resulting scripts. - [INDIRECT_PROMPT_INJECTION]: The tool processes user-defined inputs such as font family names and numeric ratios. It employs robust sanitization techniques to handle these inputs.
- Ingestion points: CLI arguments for
scripts/scale.py, specifically--correctionand--display. - Boundary markers: Not present as the inputs are handled as structured CLI arguments rather than free-form natural language prompts.
- Capability inventory: The script has the capability to write files locally using
Path.write_text. - Sanitization: Input is sanitized through strict type enforcement (e.g., float validation via
argparse) and secure JSON serialization in the code generation path.
Audit Metadata