sticky-synthesis
Pass
Audited by Gen Agent Trust Hub on Aug 19, 2026
Risk Level: SAFEPROMPT_INJECTION
Full Analysis
- [SAFE]: No malicious patterns, obfuscation, or unauthorized network activity were detected in the skill instructions. The logic is strictly focused on content synthesis and organization within a design context.
- [PROMPT_INJECTION]: The skill processes untrusted external data (sticky notes) from Figma Design files or text inputs, creating a surface for indirect prompt injection. However, the synthesis focus and lack of dangerous tools mitigate this risk.
- Ingestion points: Figma sticky notes or supplied text content (SKILL.md).
- Boundary markers: None specified to delimit input content from instructions.
- Capability inventory: The skill can read from and propose/apply edits (groupings and labels) to the Figma Design canvas if the environment supports it.
- Sanitization: No explicit content filtering or sanitization is defined.
Audit Metadata