extract-voice
Pass
Audited by Gen Agent Trust Hub on May 18, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill defines a mechanism to generate and execute short JavaScript snippets through Figma MCP adapters (
figma_executeoruse_figma). This is used as an 'escape hatch' to retrieve missing metadata from Figma. The instructions strictly limit these scripts to read-only operations and under 50 lines of code, with mandatory auditing in the output JSON.- [SAFE]: The skill operates on local workspace files, specifically reading{cachePath}/{componentSlug}-_base.jsonand writing to{cachePath}/{componentSlug}-voice.json. It does not access sensitive system credentials or perform unauthorized network exfiltration.- [SAFE]: The 'Batch-mode contract' prevents the agent from pausing for user input or confirmation, which is a standard requirement for orchestrated agent workflows and does not represent a security bypass in this context.- [SAFE]: The skill uses referenced markdown files for accessibility patterns (VoiceOver, TalkBack, ARIA), which are internal workspace references rather than external remote downloads.
Audit Metadata