figma

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow calls the Figma MCP tools (e.g., get_design_context, get_screenshot) which return Figma-authored design data and code snippets that the agent then places into the LLM context, creating an indirect prompt-injection surface from outsider-controlled Figma content.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill declares and uses the streamable MCP server at https://mcp.figma.com/mcp as a runtime tool (agents/openai.yaml and references/figma-mcp-config.md), and that server returns design contexts and code which are injected into the agent's context and directly drive implementation decisions, making it a required remote dependency that influences prompts/behavior.