figma-generate-diagram
Pass
Audited by Gen Agent Trust Hub on Jul 8, 2026
Risk Level: SAFENO_CODE
Full Analysis
- Indirect Prompt Injection Surface: The skill is designed to ingest data from external sources, such as source code, documentation, and other MCP servers, to provide context for diagram generation. This is a standard operational surface for AI agents, but it is noted as it involves processing untrusted content.
- Ingestion points: The instructions in
SKILL.md(Step 4) direct the agent to read from source code files, user-provided documents (PRDs, specs), and other connected tools. - Boundary markers: The skill does not currently specify the use of delimiters or specific instructions to ignore embedded prompts within the gathered context.
- Capability inventory: The agent uses tools including
generate_diagram,use_figma, and filesystem read operations to perform its tasks. - Sanitization: There are no explicit sanitization or validation steps mentioned for the content retrieved from external sources before it is formatted into Mermaid syntax.
Audit Metadata