figma-use
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides detailed documentation, best practices, and implementation patterns for the Figma Plugin API. It includes a pre-flight checklist and verification protocols to ensure correctness and recoverability during canvas operations.
- [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest external data from Figma files, such as node names, descriptions, and text content. This represents a potential attack surface for indirect prompt injection where malicious content within a Figma file could attempt to influence the agent's behavior. However, the skill provides specific guidance on structural validation and evidence-based checks to mitigate these risks.
- [EXTERNAL_DOWNLOADS]: The skill references resources from Figma's official documentation and GitHub guides. These are established service providers and the references are used neutrally for context and source synchronization.
Audit Metadata