figma
Warn
Audited by Snyk on Aug 21, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). Skill.md’s Phase-4 “Motion (connector-assisted)” requires using a compatible Figma connector to retrieve motion context JSON for the parent frame, then normalizes it into MotionDoc and runs verify-motion.mjs on the exported videos, so outsider-written free text can reach the LLM via connector-provided fields if the connector passes through untrusted JSON/text.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata