figma-to-ids
Pass
Audited by Gen Agent Trust Hub on Sep 24, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
figma-developer-mcppackage and Iress vendor libraries@iress-oss/ids-componentsand@iress-oss/ids-tokensfrom the npm registry. - [REMOTE_CODE_EXECUTION]: Setup instructions include the command
npx -y figma-developer-mcp, which downloads and executes external code at runtime. - [COMMAND_EXECUTION]: Documentation provides commands for users to install dependencies and configure the agent via
npmandkiro-cli. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted Figma design metadata, creating a surface for embedded instructions within design specs to potentially influence agent behavior.
- Ingestion points: Figma design frames and exported specs from
SKILL.md. - Boundary markers: None identified; no delimiters are suggested to separate design data from system instructions.
- Capability inventory: Interprets Figma layout properties to generate functional React/TypeScript code.
- Sanitization: No instructions provided for sanitizing or validating design metadata values.
Audit Metadata