figma

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Figma MCP server tools and prompts can read Figma selection/design context and code-connect context at runtime (e.g., get_design_context / get_context_for_code_connect), which originates from user-authored Figma content like component names, variant labels, and freeform text in the file.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The docs instruct MCP clients to connect at runtime to the remote Figma MCP server (https://mcp.figma.com/mcp), which is an external runtime endpoint that injects custom AI instructions/tool outputs into agents and can therefore directly control prompts.