cursor-talk-to-figma-mcp
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill provides instructions to download and execute an installation script for the Bun runtime from https://bun.sh/install. While this is the official installation method for a well-known service, it involves piping a remote script directly to a shell.\n- [REMOTE_CODE_EXECUTION]: The installation process involves running the cursor-talk-to-figma-mcp package from the NPM registry using bunx, which downloads and executes the latest version of the server code at runtime.\n- [COMMAND_EXECUTION]: The skill uses local commands (bun setup, bun socket) to automate the configuration and execution of the MCP server, relying on scripts defined in the local environment.\n- [INDIRECT_PROMPT_INJECTION]: The skill retrieves text nodes and structure from Figma designs, creating a channel for untrusted external content to enter the agent's context. Maliciously crafted design files could be used to influence the agent's behavior.\n
- Ingestion points: Figma design data retrieved through document scanning tools such as get_document_info and scan_text_nodes (SKILL.md).\n
- Boundary markers: Absent; no delimiters or instructions are specified for the agent to ignore content within the design data.\n
- Capability inventory: The agent can modify Figma files, create elements, and update local configuration files (~/.cursor/mcp.json).\n
- Sanitization: No sanitization of Figma data is mentioned or performed before it is processed by the AI agent.
Recommendations
- HIGH: Downloads and executes remote code from: https://bun.sh/install - DO NOT USE without thorough review
Audit Metadata