skills/reason-machines/design-skills/vibefigma-figma-to-react/Snyk

vibefigma-figma-to-react

Warn

Audited by Snyk on Sep 16, 2026

Risk Level: MEDIUM

Full Analysis

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (low risk: 0.10). The required workflow ingests Figma design URLs and metadata via the Figma API, which are selected URLs rather than unmonitored outsider-authored feeds.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

Potentially malicious external URL detected (medium risk: 0.30). The skill utilizes third-party/community repositories and packages via npm/npx (vibefigma) hosted on npmjs and GitHub (vibeflowing-inc/vibe_figma) without strong first-party verification.

Issues (2)

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

W012

MEDIUM

Unverifiable external dependency detected (runtime URL that controls agent).

Audit Metadata

Risk Level

MEDIUM

Analyzed

Sep 16, 2026, 03:57 AM

Issues

2