figma-ui-mcp-bridge
Fail
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: HIGHEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs users to download a
plugin.zipfrom a personal GitHub repository (TranHoaiHung/figma-ui-mcp). This source is not associated with the stated author (ara.so) or the verified vendor, posing a significant supply chain risk. - [REMOTE_CODE_EXECUTION]: The installation process uses
npx figma-ui-mcp, which fetches and executes code from the NPM registry at runtime without version pinning or integrity checks. - [COMMAND_EXECUTION]: The skill provides shell commands for users to add the MCP server to various IDE configurations (Claude, Cursor, VS Code, Windsurf), leading to the execution of external code.
- [DYNAMIC_EXECUTION]: The
figma_writetool enables the agent to execute JavaScript operations directly within the Figma Desktop environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from Figma documents via
figma_read(structured data and screenshots). Malicious instructions embedded in a Figma file could influence the agent's behavior. - Ingestion points:
figma_readtool operations (e.g.,get_design_context,get_selection) inSKILL.md. - Boundary markers: Absent; the agent is instructed to read designs as structured data without explicit delimiters or safety warnings for the ingested content.
- Capability inventory:
figma_write(JavaScript execution), file system access via the hosting IDE, and network communication via the local MCP bridge. - Sanitization: None specified for the data retrieved from the Figma API.
Recommendations
- AI detected serious security threats
Audit Metadata