figma-implement-motion
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to use
curlto retrieve the contents of SVG assets from Figma asset URLs for the purpose of inlining them into the code. This is a standard and safe developer workflow within this context. - [EXTERNAL_DOWNLOADS]: The skill fetches design assets (SVGs) from Figma's official asset API endpoints. This is consistent with the skill's primary purpose and targets a well-known, trusted service.
- [INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface for indirect prompt injection as it ingests and processes data from Figma design and motion tools. 1. Ingestion points: Data retrieved via
get_design_contextandget_motion_contexttools (SKILL.md). 2. Boundary markers: Explicit boundary markers for untrusted content are absent. 3. Capability inventory: The skill instructions include usingcurlfor network requests and performing codebase modifications. 4. Sanitization: No specific sanitization or validation of the tool output content is described.
Audit Metadata