figma-researcher

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The SKILL.md explicitly instructs the agent to call the Figma MCP server (ListMcpResourcesTool and MCP tools like get_metadata, get_design_context, get_screenshot, get_variable_defs) to fetch and interpret user-provided Figma files and screenshots — untrusted third-party content that can materially influence subsequent tool use and decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill explicitly requires configuring and querying a remote Figma MCP server (configured at https://mcp.figma.com/mcp) and uses the documentation/resources returned at runtime (via ListMcpResourcesTool) to determine available tools and how the agent should act, so this external URL directly controls agent behavior at runtime.