figma-deploy-integration

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill uses platform-specific command-line interfaces (vercel, gcloud, fly) to perform deployment tasks and manage environment secrets. These operations are confined to the intended deployment workflows and follow recommended practices for production environments.
  • [EXTERNAL_DOWNLOADS]: The skill references official documentation and resources from established platforms including Vercel, Google Cloud, and Fly.io. It also references the author's own domains (tonsofskills.com, intentsolutions.io, jeremylongshore.com) for additional context and reference materials.
  • [INDIRECT_PROMPT_INJECTION]: The provided webhook receiver code in api/webhooks/figma.ts processes external JSON payloads.
  • Ingestion points: The POST handler in api/webhooks/figma.ts ingests JSON data from Figma webhooks.
  • Boundary markers: None explicit in the code snippet.
  • Capability inventory: The skill includes Bash capabilities for deployment tools (vercel, fly, gcloud) and file Write access.
  • Sanitization: The code implements a passcode verification check using crypto.timingSafeEqual to ensure only authorized Figma events are processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:44 AM
Security Audit — agent-trust-hub — figma-deploy-integration