figma-design-md-generator
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation instructions require users to clone a repository from https://github.com/bergside/design-md-figma.git. This is an external repository that is not associated with a trusted vendor or the skill author.
- [COMMAND_EXECUTION]: The skill provides commands for the user to run npm install and npm run build on the downloaded repository. This action executes build scripts and installs third-party dependencies from an unverified source.
- [INDIRECT_PROMPT_INJECTION]: The skill extracts text data from Figma files (such as style, variable, and component names) and includes them in generated SKILL.md and DESIGN.md files. There are no boundary markers or sanitization logic shown to prevent malicious data in the Figma file from injecting instructions to downstream AI agents. (Ingestion points: SKILL.md via extraction functions in code.ts; Boundary markers: Absent; Capability inventory: git clone, npm install, npm run build; Sanitization: Absent)
Audit Metadata