figma-deploy-integration
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses platform-specific command-line interfaces (
vercel,gcloud,fly) to perform deployment tasks and manage environment secrets. These operations are confined to the intended deployment workflows and follow recommended practices for production environments. - [EXTERNAL_DOWNLOADS]: The skill references official documentation and resources from established platforms including Vercel, Google Cloud, and Fly.io. It also references the author's own domains (
tonsofskills.com,intentsolutions.io,jeremylongshore.com) for additional context and reference materials. - [INDIRECT_PROMPT_INJECTION]: The provided webhook receiver code in
api/webhooks/figma.tsprocesses external JSON payloads. - Ingestion points: The
POSThandler inapi/webhooks/figma.tsingests JSON data from Figma webhooks. - Boundary markers: None explicit in the code snippet.
- Capability inventory: The skill includes
Bashcapabilities for deployment tools (vercel,fly,gcloud) and fileWriteaccess. - Sanitization: The code implements a passcode verification check using
crypto.timingSafeEqualto ensure only authorized Figma events are processed.
Audit Metadata