figma-use-motion
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [SAFE]: The skill follows secure coding practices for Figma Plugin API interactions. It identifies specific API boundaries and discourages the use of internal or non-public properties. No evidence of malicious intent, prompt injection, or data exfiltration was found.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes canvas data from Figma (selection and node IDs). 1. Ingestion points:
figma.currentPage.selectionandfigma.getNodeByIdAsync(documented inreferences/motion-patterns.md). 2. Boundary markers: Not explicitly defined for the input data. 3. Capability inventory: Modification of visual node properties (transforms, colors, opacities) and animation style application. 4. Sanitization: Relies on native Figma Plugin API type validation. The risk is minimized by the skill's focus on structured property updates rather than interpreting text as logic.\n- [DYNAMIC_EXECUTION]: The JavaScript code snippets provided are static templates for theuse_figmatool and do not involve runtime compilation or execution of untrusted code strings.
Audit Metadata