figma-to-unity
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest data from external Figma URLs provided by the user at runtime. This creates a surface for indirect prompt injection, where malicious instructions embedded in Figma layer names or text content could theoretically attempt to influence the generated C# code or agent behavior. However, the skill significantly mitigates this risk by instructing the agent to treat Figma output only as a 'representation of design' and to 're-express' it using specific project design tokens and UXML/USS conventions rather than blindly copying content.
Audit Metadata