figma-canvas-editor
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill instructions define a strictly scoped workflow for Figma mutations, requiring explicit node identification and scope confirmation before execution. This design minimizes the risk of unintended or unauthorized changes to design files.\n- [SAFE]: Mutation boundaries are explicitly established, preventing the agent from performing destructive actions (like detaching instances or deleting nodes) without direct user request and duplicate-based rollback strategies.\n- [SAFE]: The skill incorporates a mandatory verification loop where current metadata is read before editing and validated again after the operation to ensure consistency and provide evidence of the changes made.\n- [SAFE]: The skill interacts with external Figma data (metadata and nodes) which is handled as a safe external service interaction.\n
- Ingestion points: Figma node metadata and canvas content reading (SKILL.md).\n
- Boundary markers: Explicit confirmation of mutation scope and target verification steps.\n
- Capability inventory: Scoped tool-based mutations (use_figma).\n
- Sanitization: Verification via post-mutation metadata readback.\n- [SAFE]: No patterns of data exfiltration, hardcoded credentials, or remote code execution were found across the skill's markdown, configuration, or evaluation files.
Audit Metadata