figma-sdk-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 9, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill contains architectural templates and code snippets for Figma API integration. All code is transparent and follows standard development practices.
- [SAFE]: Authentication tokens are managed through environment variables (FIGMA_PAT), preventing credential leakage in source code.
- [SAFE]: All external resources and links point to official documentation, trusted registries, or the author's professional domains.
- [INDIRECT_PROMPT_INJECTION]: The patterns facilitate reading data from external Figma files, which is a potential surface for indirect prompt injection.
- Ingestion points: Data is ingested via the REST API in src/figma-client.ts.
- Boundary markers: None present in the snippets.
- Capability inventory: The skill uses platform tools for file manipulation.
- Sanitization: No sanitization is performed on ingested text content.
Audit Metadata