figma-rate-limits

Pass

Audited by Gen Agent Trust Hub on Sep 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill references the well-known p-queue Node.js package in its implementation examples for managing request concurrency.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for ingesting and processing external data from the Figma API, which represents a potential surface for indirect prompt injection.\n
  • Ingestion points: The figmaFetchWithRetry function in SKILL.md reads headers such as Retry-After and X-Figma-Rate-Limit-Type from external API responses.\n
  • Boundary markers: No explicit delimiters or instructions are used to separate ingested header data from the agent's logic.\n
  • Capability inventory: The skill is designed to perform network operations using the fetch API.\n
  • Sanitization: The implementation uses parseInt() to validate the Retry-After header value before use.\n- [COMMAND_EXECUTION]: The skill provides educational shell commands using curl to demonstrate how to identify rate limit headers. These examples correctly use environment variable placeholders (e.g., ${FIGMA_PAT}) rather than hardcoded credentials.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 9, 2026, 03:48 AM
Security Audit — agent-trust-hub — figma-rate-limits