figma-use
Pass
Audited by Gen Agent Trust Hub on Apr 13, 2026
Risk Level: SAFE
Full Analysis
- Execution Environment Constraints: The skill documentation identifies that certain interactive or external-facing APIs, such as
figma.openExternalandfigma.notify, are restricted or disabled. This helps ensure that the agent's operations remain within the intended Figma canvas context.\n- Incremental Development Workflow: The skill mandates a 'read-before-write' approach, where the agent is instructed to inspect the current file state before making modifications. This practice, combined with mandatory validation steps using metadata or screenshots, serves as a safeguard against unintended large-scale changes.\n- Structured Data Handling: Patterns for creating and binding variables, components, and styles are provided with explicit warnings about common pitfalls, such as color range validation and immutable property reassignment. These rules promote the generation of stable and predictable plugin code.\n- Contextual Awareness of External Data: The skill involves processing data retrieved from Figma files, such as node names and component properties. While this creates a surface for indirect prompt injection from file content, the skill's emphasis on technical validation and developer-oriented auditing helps mitigate the risk of the agent misinterpreting potentially unconventional content within the design file.
Audit Metadata