figma-design-to-code
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [PROMPT_INJECTION]: The skill establishes a workflow that ingests external, untrusted design data from Figma nodes, creating a vulnerability surface for indirect prompt injection where malicious instructions could be embedded in the design source. * Ingestion points: Data retrieved via the
get_design_contexttool, including design hints, code snippets, and annotations (SKILL.md). * Boundary markers: Absent. The skill lacks instructions for the agent to delimit or ignore instructions that may be embedded within the design context. * Capability inventory: The skill directs the agent to generate and write code directly into the target project's filesystem based on external input (SKILL.md). * Sanitization: Absent. There are no requirements for validating or filtering the design data before implementation. - [EXTERNAL_DOWNLOADS]: The skill instructs the agent to perform network operations to download and commit binary assets from external sources. * Remote Source: The skill references remote asset URLs matching the pattern
https://.../api/mcp/asset/...(SKILL.md). * Action: The agent is explicitly told to 'download-and-commit the exact asset bytes' from these external URLs into the repository codebase.
Audit Metadata