figma-core-workflow-a
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external Figma files (style names, typography properties, and descriptions) that could potentially contain malicious instructions or unexpected content designed to influence the agent.
- Ingestion points: Figma API responses fetched in
SKILL.mdviaclient.getFile()andclient.getFileNodes(). - Boundary markers: None present in the code snippets to distinguish between instructions and ingested data.
- Capability inventory: File system write access (
writeFileSync), network access (curl), and shell execution (Bash(npm:*)). - Sanitization: Token names are sanitized for CSS variable usage using
.toLowerCase().replace(/[\s/]+/g, '-')inSKILL.md. - [DATA_EXPOSURE]: The skill handles sensitive credentials (
FIGMA_PAT) to authenticate API requests. It follows best practices by retrieving these from environment variables rather than hardcoding them. The requests are directed to the officialapi.figma.comendpoint. - [EXTERNAL_DOWNLOADS]: The skill utilizes
curlto fetch data fromapi.figma.com. This is the official API endpoint for a well-known service, and the data fetched is used specifically for the skill's stated purpose of design token extraction.
Audit Metadata