figma-design-system-to-design-md
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of a plugin from an external GitHub repository (github.com/albertzhangz10/figma-design-system-to-design-md), which is a standard method for Claude Code extensions.
- [COMMAND_EXECUTION]: The documentation specifies commands for installing, developing, and running the plugin via the Claude CLI.
- [INDIRECT_PROMPT_INJECTION]: The tool ingests data from local project files (CSS, TypeScript, JSON) and Figma API data to generate markdown documentation. Ingestion points: CSS/JS/JSON/Tailwind files, Figma MCP. Boundary markers: Absent. Capability inventory: File read/write. Sanitization: Not specified. This presents a surface for indirect prompt injection if source files were to contain malicious instructions intended to be reflected in the final documentation used by other AI agents.
- [SAFE]: The skill follows security best practices by explicitly instructing users to manage Figma API tokens using local environment files and .gitignore to prevent accidental credential exposure.
Audit Metadata