agent-figma
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from the Figma API (such as designer notes, comments, and text layers) which can be used as a vector for indirect prompt injection if an attacker-controlled design file contains malicious instructions designed to influence the agent's behavior.\n
- Ingestion points: Multiple commands described in SKILL.md and references/reading-nodes.md (e.g.,
nodes get,nodes notes,handoff) fetch and present natural language content from external Figma files to the agent.\n - Boundary markers: The CLI tool outputs data in NDJSON format, providing structural separation, but the actual content within the text fields (e.g.,
text,label,message) remains unconstrained natural language.\n - Capability inventory: The agent is granted
Bashaccess to theagent-figmatool andReadaccess to the local filesystem. This is typically used in code generation workflows where design input directly influences the output code.\n - Sanitization: The instructions do not specify any sanitization or filtering of the content retrieved from Figma before it is provided to the agent's context.
Audit Metadata