figma-automation

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). SKILL.md describes calling Figma tools that return file data/components/comments (runtime LLM context would be populated with those tool outputs, which can include outsider-authored Figma comment text and other free-form content from the target files); specifically the “Manage Comments and Versions” workflow implies ingesting comment bodies when FIGMA_GET_COMMENTS_IN_A_FILE is used.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill instructs adding the MCP endpoint https://rube.app/mcp to the client so RUBE_SEARCH_TOOLS can fetch current tool schemas at runtime, meaning remote content from that URL can directly control agent tools/instructions.