figma-generate-library
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is designed for Figma automation and performs expected operations such as reading codebase configuration files (CSS, JSON, etc.) and executing Figma Plugin API scripts. All actions are well-documented and align with the skill's primary function.
- [INDIRECT_PROMPT_INJECTION]: The skill includes an inherent surface for indirect prompt injection as it processes untrusted data from user codebases. However, the risk is mitigated through a rigorous 'Verification Protocol' and 'Discovery Phase' that require the agent to validate findings and obtain user approval for conflicts before performing mutations.
- [DYNAMIC_EXECUTION]: The workflow relies on assembling and executing JavaScript snippets via the
use_figmatool. The skill manages this securely by using pre-defined helper scripts in thescripts/directory, rather than generating arbitrary code from scratch, which minimizes the risk of execution errors or malicious injection.
Audit Metadata