figma-create-new-file
Pass
Audited by Gen Agent Trust Hub on Oct 14, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- Indirect Prompt Injection Surface: The skill processes user-provided inputs such as
fileNameandeditorTypeto execute tool calls. While this is a standard ingestion point for untrusted data, the skill acts as a direct wrapper for thecreate_new_filetool and does not interpolate these values into sensitive system prompts or execution contexts that could override agent behavior. - Ingestion Points: User arguments provided via the
/figma-create-new-filecommand. - Boundary Markers: The skill does not explicitly define delimiters for these inputs, relying on the tool's parameter structure.
- Capability Inventory: The skill utilizes the
create_new_fileandwhoamiMCP tools to perform intended Figma operations. - Sanitization: The skill follows standard parameter parsing for tool invocation without additional filtering layers.
- Instructional Integrity: The use of mandatory language (e.g., "MANDATORY prerequisite") is used to enforce a specific technical workflow for the agent and does not represent an attempt to bypass safety guidelines or inject malicious instructions.
Audit Metadata