figma-rate-limits
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references the well-known
p-queueNode.js package in its implementation examples for managing request concurrency.\n- [INDIRECT_PROMPT_INJECTION]: The skill provides logic for ingesting and processing external data from the Figma API, which represents a potential surface for indirect prompt injection.\n - Ingestion points: The
figmaFetchWithRetryfunction inSKILL.mdreads headers such asRetry-AfterandX-Figma-Rate-Limit-Typefrom external API responses.\n - Boundary markers: No explicit delimiters or instructions are used to separate ingested header data from the agent's logic.\n
- Capability inventory: The skill is designed to perform network operations using the
fetchAPI.\n - Sanitization: The implementation uses
parseInt()to validate theRetry-Afterheader value before use.\n- [COMMAND_EXECUTION]: The skill provides educational shell commands usingcurlto demonstrate how to identify rate limit headers. These examples correctly use environment variable placeholders (e.g.,${FIGMA_PAT}) rather than hardcoded credentials.
Audit Metadata