integrating-figma
Pass
Audited by Gen Agent Trust Hub on Apr 4, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates with the official Figma API at api.figma.com to retrieve design data and download assets, which is a legitimate and well-known service.
- [SAFE]: File system operations are restricted to writing design tokens, assets (PNG/SVG), and generated source code (React/TypeScript) to local directories, consistent with the stated automation purpose.
- [SAFE]: The skill promotes security best practices by recommending the storage of sensitive Figma API tokens in .env files rather than hardcoding them within the scripts.
- [SAFE]: Although the skill generates executable React components from Figma design data, this behavior is the primary intended function and follows standard code generation patterns for developer tooling.
Audit Metadata