vibefigma-figma-to-react
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation recommends running 'npx vibefigma' or installing the 'vibefigma' package via NPM, which fetches code from the public NPM registry at runtime.
- [REMOTE_CODE_EXECUTION]: The use of 'npx' results in the execution of the downloaded third-party package code on the local system.
- [INDIRECT_PROMPT_INJECTION]: The tool ingests design data from Figma URLs. When the AI cleaning feature is used via the '--clean' flag, this external data is passed to a language model, creating a potential surface for instructions within the design to influence the code output. Evidence Chain: (1) Ingestion points: Figma design data accessed via external URLs in SKILL.md. (2) Boundary markers: No explicit boundary markers or warnings to ignore embedded instructions are provided. (3) Capability inventory: Code generation, asset downloading, and optional AI-assisted code refinement. (4) Sanitization: No evidence of sanitization or filtering for the design content before processing.
- [DYNAMIC_EXECUTION]: The skill's core purpose is to dynamically generate React and TypeScript code files based on external design specifications provided by the user.
Audit Metadata