figma
Pass
Audited by Gen Agent Trust Hub on Oct 11, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill serves as a developer guide for Figma integration. All code examples use standard libraries and follow security best practices, such as recommending the use of environment variables for API tokens rather than hardcoding them.
- [INDIRECT_PROMPT_INJECTION]: The skill provides instructions for the agent to fetch data from the Figma REST API. This creates an ingestion surface where content from external Figma files enters the agent's context. * Ingestion points: Figma REST API endpoints (api.figma.com) referenced in SKILL.md. * Boundary markers: Not explicitly defined in the example snippets. * Capability inventory: Data fetching via curl and axios, followed by data transformation and logging. * Sanitization: Not present in the simplified code examples.
Audit Metadata