huolala-figma-mcp
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the installation of the Figma-to-code service by cloning the repository from the official HuolalaTech GitHub organization (
github.com/HuolalaTech/huolala-figma-mcp). As a recognized technology entity, this download is considered part of the legitimate functionality of the tool. - [CREDENTIALS_UNSAFE]: Security best practices are observed regarding sensitive data. The instructions explicitly direct users to store Figma and OpenAI API keys in a
.envfile or environment variables, avoiding hardcoded secrets. - [INDIRECT_PROMPT_INJECTION]: The skill processes external data via Figma URLs to generate UI code. While this constitutes an attack surface for indirect prompt injection (where malicious design metadata could influence AI generation), the multi-stage conversion process (Figma API -> DSL -> HTML) and the requirement for authenticated API access minimize the risk of accidental execution or exploit.
- [COMMAND_EXECUTION]: The documentation includes standard development commands for environment setup and service execution (e.g.,
pip install,python -m mdap_u2c). These commands are necessary for the skill's stated purpose and operate within the user's local environment.
Audit Metadata