work-with-design-systems
Warn
Audited by Gen Agent Trust Hub on Oct 22, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_CONTEXT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructions direct the agent to fetch and install its full content from a remote repository at
https://github.com/natdexterra/work-with-design-systems. This source is not among the recognized trusted organizations. - [COMMAND_EXECUTION]: The installation procedure relies on executing shell commands via
npx skills add. This allows the installation tool to download and set up code from an external source, which may have implications for the integrity of the agent's local environment. - [DYNAMIC_CONTEXT_INJECTION]: The documentation explicitly encourages the use of the
!prefix to execute shell commands (e.g., checking for existing skill files). This syntax allows for direct command execution within the agent's environment, which can be leveraged for more complex or harmful operations if not carefully monitored. - [INDIRECT_PROMPT_INJECTION]: The skill's core functionality involves auditing Figma design systems. This represents a data ingestion surface where maliciously formatted component descriptions or metadata in Figma could attempt to influence the agent's logic during the Inspect or Build phases.
- Ingestion points: Figma design system data (components, descriptions, tokens) retrieved via the Figma MCP server.
- Boundary markers: None identified in the provided instructions to separate design data from agent instructions.
- Capability inventory: Ability to read from Figma and write to the local file system (creating
tokens.cssand AI rules files). - Sanitization: No explicit sanitization or validation of the ingested Figma metadata is described.
Audit Metadata