figma-doc
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill utilizes a local Node.js script located at
scripts/figma_cmd.mjsto communicate with a Figma plugin. This script acts as a bridge for creating frames and text nodes within the Figma environment. - [INDIRECT_PROMPT_INJECTION]: The skill ingests user-provided topics, specs, and descriptions to generate document content, which represents a potential injection surface.
- Ingestion points: User-provided topics and descriptions defined in the workflow section of SKILL.md.
- Boundary markers: Instructions direct the agent to organize content into a structured JSON schema, which serves as a delimiter.
- Capability inventory: The
create_doc_pagecommand allows for the creation of structured layout frames, text nodes, and tables in Figma. - Sanitization: The skill relies on the AI agent's ability to correctly format the JSON parameters before execution; no secondary sanitization logic is described in the prompt.
Audit Metadata