figma-generate-design
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- [Indirect Prompt Injection Surface]: This skill processes untrusted data from user-provided source code or screen descriptions as specified in the prerequisites section of SKILL.md (Ingestion points). The current workflow does not explicitly define distinct boundary markers or specific warnings to ignore embedded instructions (Boundary markers). The skill leverages the use_figma tool to execute JavaScript code within the Figma environment (Capability inventory). No specific sanitization or filtering of external content is described (Sanitization). While inherent to its task of translating descriptions into designs, this structure presents a surface where crafted inputs could attempt to influence agent logic.
- [Dynamic Script Generation]: To automate Figma operations, the skill dynamically generates JavaScript instructions. This process is used to create and update components, apply styles, and bind variables based on the design system. This represents a functional pattern necessary for the skill's purpose of incremental design assembly.
Audit Metadata