figma-from-code
Pass
Audited by Gen Agent Trust Hub on Oct 31, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests and maps the user's codebase, which constitutes processing untrusted data. Malicious instructions placed in code comments or strings could potentially manipulate the agent's behavior during the design generation process.
- Ingestion points: Source code files from the local repository are read to extract routes, tokens, and components as described in SKILL.md.
- Boundary markers: There are no explicit instructions to use delimiters or sanitization when processing this external content.
- Capability inventory: The agent can write to external Figma files (use_figma), capture screenshots (get_screenshot), and interact with the browser via the 'Claude in Chrome' extension.
- Sanitization: No input sanitization or validation of the code content is present.- [COMMAND_EXECUTION]: In SKILL.md (Step 2), the agent is instructed to start local simulators, emulators, or development servers. This requires the execution of shell commands tailored to the specific technology stack found in the user's repository.- [DYNAMIC_EXECUTION]: The skill provides and uses JavaScript files (e.g., scripts/prelude.js and font-swap-plugin/code.js) that are injected and executed within the Figma environment or the browser console to perform tasks like font swapping and layout generation.
Audit Metadata