figma

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow calls the Figma MCP tools (get_design_context, get_metadata, get_screenshot, and asset download) which ingest Figma frame/layer content authored by third parties (i.e., non-operating-user Figma collaborators) into the agent’s LLM context as readable design/React+Tailwind text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill declares and uses the remote MCP tool at https://mcp.figma.com/mcp (in agents/openai.yaml and config snippets), which is called at runtime to fetch design context and generated React/Tailwind code that the agent consumes to drive implementation decisions, so this external URL directly controls agent prompts/output.