figma-use

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The skill provides detailed documentation, best practices, and implementation patterns for the Figma Plugin API. It includes a pre-flight checklist and verification protocols to ensure correctness and recoverability during canvas operations.
  • [INDIRECT_PROMPT_INJECTION]: The skill defines workflows that ingest external data from Figma files, such as node names, descriptions, and text content. This represents a potential attack surface for indirect prompt injection where malicious content within a Figma file could attempt to influence the agent's behavior. However, the skill provides specific guidance on structural validation and evidence-based checks to mitigate these risks.
  • [EXTERNAL_DOWNLOADS]: The skill references resources from Figma's official documentation and GitHub guides. These are established service providers and the references are used neutrally for context and source synchronization.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 11:15 AM