figma-code-to-canvas
Pass
Audited by Gen Agent Trust Hub on Jul 29, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill processes content from external and local URLs, creating a surface for indirect prompt injection where malicious instructions embedded in web pages could influence agent actions.
- Ingestion points: Web pages via public, private, or local URLs identified in SKILL.md.
- Boundary markers: The instructions lack explicit delimiters for external content, although they define specific privacy modes.
- Capability inventory: The skill invokes the figma:figma-generate-design tool as described in SKILL.md.
- Sanitization: Workflow step 4 in SKILL.md mandates explicit approval before sending private or authenticated data to remote services.
- [DATA_EXFILTRATION]: The skill is designed to interact with local development servers and staging environments which may contain sensitive application state. This risk is effectively mitigated by explicit instructions in SKILL.md and the expected behaviors in evals/evals.json, which prioritize privacy and require human approval for authenticated content.
Audit Metadata