figma-copy-rewriter
Pass
Audited by Gen Agent Trust Hub on Sep 4, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted text nodes from Figma files, creating a potential surface for indirect prompt injection where malicious content in a design could influence the agent's behavior.
- Ingestion points: Text nodes are extracted from Figma pages and frames using the
use_figmatool in Phase 1 of SKILL.md. - Boundary markers: The skill does not explicitly use delimiters to wrap the extracted text nodes during the audit phase.
- Capability inventory: The skill possesses the ability to modify Figma content via script execution through the
use_figmatool in Phase 5 of SKILL.md. - Sanitization: The risk is mitigated by a mandatory Phase 4 review step, where the user must explicitly approve any proposed changes before they are pushed back to the Figma file.
- [COMMAND_EXECUTION]: The skill utilizes the
use_figmatool to execute JavaScript code within the Figma environment for both reading data and writing updates. - Evidence: Phase 1 and Phase 5 scripts in SKILL.md demonstrate programmatic interaction with the Figma API (
figma.root.findAll,figma.loadFontAsync, etc.). - Context: These operations are essential for the skill's stated purpose of UI copy auditing and are handled through the platform's official Figma integration tool.
Audit Metadata