figma-implement-motion
Pass
Audited by Gen Agent Trust Hub on Jul 20, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- Data Ingestion Surface: The skill processes structured information retrieved from Figma via specific MCP tools (
get_design_contextandget_motion_context). This data serves as the foundation for the generated application code. - Ingestion points:
SKILL.md(Step 1 and Step 2 instructions) calls external tools to fetch design and motion data. - Boundary markers: The skill relies on structured JSON responses from the Figma MCP tools rather than raw user input, which naturally limits injection surfaces.
- Capability inventory: The skill identifies the need to write code to the local repository and perform network operations to fetch assets.
- Sanitization: The instructions focus on direct mapping of design values to code properties; implementers should ensure standard validation when handling external URLs.
- Asset Retrieval via Network: To support complex animations like SVG path-level motion, the instructions suggest using tools like
curlto fetch asset markup directly from Figma-linked URLs. This allows the agent to inline SVG content into the generated code. - Evidence: Rule 6 in
SKILL.mdand instructions inreferences/svg-and-path-motion.mdspecify fetching assets via URL for inlining.
Audit Metadata